Hello,
I'm trying to extract a field, and then run a timechart with the max value over 5 minutes.
My extraction is strictly the tail integer of this string:
<server2name-loc-l1p.domain.com@10.10.10.10#sessions=568>
Best looking solution I found so far is:
| rex field=_raw ".*#sessions +(?<number>[0-9]+)" |timechart span="5m" max(number)
But it does nothing.
We solved it by going a whole different direction. I was fooling with a super long string, but my co-worker came up with:
rex ".*=(?P\d+)\D"
We're good!
We solved it by going a whole different direction. I was fooling with a super long string, but my co-worker came up with:
rex ".*=(?P\d+)\D"
We're good!
What happens if you table out the number values first ? Is your extraction working?
| rex field=_raw ".*#sessions +(?<number>[0-9]+)"
| table number