I have this statement:
10.211.1.114 10.222.3.33:4331 - 2016-09-07 14:10:06 0.004 GET /openapi-rest-web/akamai-object.htm - 200 6548 "Java/1.7.0_45" "54.444.444.444" - null [corRID::null] [KEY::-HTTPMonitor-Loyalty] [UID::-]
I am trying to grab the 0.004
10.200.1.200 10.002.0.98:012 - 2016-09-07 14:40:06 0.39 POST /openapi-rest-web/v1/kohlsCash - 200 918 "Apache-HttpClient/4.3.3 (java 1.5)" "100.100.00.187, 144.41.141.00, 144.41.141.44, 54.009.200.002, 144.41.141.44" - null [corRID::NAID-iOS-98797AB9-2978-4987-90CA-059879789-1473276124.978987] [KEY::NUNlVg4532432523mLL8MEpqVvxW9] [UID::-]
I am trying to grab the 0.39
I have this regular expression so far: ^.*(GET|POST)
Which gets me everything before the GET or POST
Any suggestions?
Try this
... | rex "(?<numbers>\d+\.\d+)\s(GET|POST)" | table numbers
This should do it
your base search | rex "^(\S+\s+){5}(?<YourFieldName>\S+)"
Try this
... | rex "(?<numbers>\d+\.\d+)\s(GET|POST)" | table numbers
Doesn't seem to work sorry, only getting blank null entries using that
| rex "(?\d+\.\d+)\s(GET|POST)" | where match(response_time,"[a-zA-Z0-9]")| table response_time
This did it