Splunk Search

need help with extracting a millisecond value from log events into a variable by using rex

saurabhCox
New Member

Hi ,

I am trying to come up with a rex expression to fetch the millisecond value appearing in the log events displayed below into a variable.

2011-08-01 14:27:24,758 INFO - 8009-4 - Successfully got security suite status to user account: 135 via securitySuite in 94 milliseconds.
2011-08-01 14:24:44,572 INFO - 8009-3 - Successfully got security suite status to user account: 138 via securitySuite in 129 milliseconds.
2011-08-01 14:23:09,193 INFO - 8009-1 - Successfully got security suite status to user account: 130 via securitySuite in 113 milliseconds.
2011-08-01 14:21:23,214 INFO - 8009-1 - Successfully got security suite status to user account: 130 via securitySuite in 1699 milliseconds.
2011-08-01 14:18:27,395 INFO - 8009-4 - Successfully got security suite status to user account: 130 via securitySuite in 112 milliseconds.

From these events, i am trying to fetch the millisecond values: 94 / 129 / 113/ 112 in a variable, so that I can have a variable say “m_sec” and it will have the millisecond value for each field , i.e m_sec=94 , m_sec=129 , m_sec=113 , m_sec=112.

Can you please help me with the rex expression to fetch these values. I have tried the field extraction and it is not able to create a field with these values.

0 Karma

Ayn
Legend

Try this:

in (?<m_sec>\d+) milliseconds
0 Karma

Ayn
Legend

Meh, the Answers site is adding another \ in the regex. That should be just one \ in front of d+.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...