Also this didnt work   index=prod-* "WEBSERVICES CALL ENDED" |rex field=time "(?<time>.*)" |where time>23 ... View more

Hi, It didn't work got this error: Error in 'rex' command: The regex '(<time>\d+)' does not extract anything. It should specify at least one named group. Format: (?<name>...). The search job has failed due to an error. You may be able view the job in....   I tried also but no results index=prod-* "WEBSERVICES CALL ENDED" |rex field=time "processing time:<(?<time>.*)> ms" |where time>10 ... View more

Hi, Thank you for your reply,I will add more info so this is my search  index=prod-* "WEBSERVICES CALL ENDED" It will return records that indicate about my API call end  (see image below) As you can see we have processing time field in our logs and also time field (by Splunk) both are equal, I would to use this time field and get only API calls that processing time is longer than 5000ms ( add alerts). Or get average API time, hope it more clear now     ... View more