Hello,
Would anyone know the regex value for the final numeric value after the last comma in the following log entry:
BlahBlah 2015/12/17 13:23:48:266,63
So all I need is the number after the last comma. It can be 1 or more digits (including zero).
I'm creating a named variable, but this doesn't work:
| rex ", (?P<TrasactionTime>\d+)$" | top 10 TrasactionTime
Thanks!
Hi agoktas,
almost correct, your regex has a whitespace too much so this will work:
your search here | rex ",(?<TrasactionTime>\d+)$" | top 10 TrasactionTime
Hope this helps ...
cheers, MuS
Hi agoktas,
almost correct, your regex has a whitespace too much so this will work:
your search here | rex ",(?<TrasactionTime>\d+)$" | top 10 TrasactionTime
Hope this helps ...
cheers, MuS
Bingo! That's it. 🙂 I knew it was close. 😉
By the way, how do you sort by the values it returns? I noticed if I do a:
| top 10 TrasactionTime
It will only return the 10 most frequent occurred values, versus the top 10 values.
after the rex instead of top
use sort TrasactionTime
for ascending or sort - TrasactionTime
for descending sort and add also | head 10
at the end to get only the the last 10 result after the sort.
Perfect.
One last thing... sorry...
How do you only allow the "TrasactionTime" column to show?
It now displays the TrasactionTime & Rawlog columns. The raw log clutters the panel.
Thanks.
either use:
| fields TrasactionTime
or
| table TrasactionTime
BTW should this be TransactionTime instead of TrasactionTime?
Feel free to up vote the additional answers - thanks :))
Table TransactionTime worked perfectly.
fields TransactionTime still had other columns.
Yes, I made a typo. "Transaction" is correct. 😉
Thanks again for all your help!
Try this
... | rex (?<TransactionTime>\d+)$ | top 10 TransactionTime