Splunk Search

Why is Regular Expression (Regex) grabbing digits in multiple cases?

JoshuaJohn
Contributor

I am trying to grab this response time

**** info[[Path::/rest/motService][corRID::NAID-iOS-DFA65777-2339-4A0802F42C6055317][KEY::8ce38e4cf][SID::ZkQfAfff1QTnEbeEJkvk1jLwy2bA!-173731PID::NULL][UID::NULL][OID::NULL][Bous::false]] Mon Sep 12 10:28:09 CDT 2016 1473694089144 /atg/dypipeline/Actoervlet Time Consumed - 492 ms

**** info[[Path::/rest/moProfileId][corRID::NAID-iOS-1AA-909C66C333C1-1473694078.419966][KEY::NUvxW9][SID::NtsfAzgu00iOHflb1o2o36_jFX!-1737314761!1473694087214][PID::NULL][UID::NULL][OID::NULL][Bous::NULL]] Mon Sep 12 10:28:07 CDT 2016 1473694087266 /atg/dypipeline/Actoervlet Time Consumed - 15 ms

**** info[[Path::/rest/ment][corRID::MCID-1126012-1473694045379][KEY::oAEItJq][SID::bSUiIeRZ8OjzE8_3jXulwL!-173786261][PID::NULL][UID::NULL][OID::NULL][Bous::false]] Mon Sep 12 10:28:06 CDT 2016 147437 /atg/dypipeline/Actoervlet Time Consumed - 37 ms

Tags (2)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Try this regex

(?<response_time>\d+)\sms$

If you want to modify it test on https://regex101.com/
Bye.
Giuseppe

View solution in original post

twinspop
Influencer
... | rex "Time Consumed - (?<time_spent>\d+)\sms"

gcusello
SplunkTrust
SplunkTrust

Try this regex

(?<response_time>\d+)\sms$

If you want to modify it test on https://regex101.com/
Bye.
Giuseppe

Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...