Splunk Search

How do I extract a number from the raw message

JeffCr
Explorer

How do I extract the following which always occurs as the last part of the raw text in message e.g "Took 13983.1468ms."
I want only the number and to capture timestamp and hostname. The total message length and structure might vary slightly but the ending is the same.

Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

I'd use rex.

index=foo | rex "Took (?<num>\d+\.?\d+)ms" | ...

If you need help extracting timestamp and hostname, please show some sample data.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

twinspop
Influencer
| rex "Took (?P<dur>\d+\.?\d*)ms"

Will put the value into dur

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I'd use rex.

index=foo | rex "Took (?<num>\d+\.?\d+)ms" | ...

If you need help extracting timestamp and hostname, please show some sample data.

---
If this reply helps you, Karma would be appreciated.

twinspop
Influencer

I think that regex is going to surprise in some situations. You are requiring that there be 2 digits. 1 or more digits, followed by optional decimal, followed by 1 or more digits.

0 Karma

JeffCr
Explorer

There will always be at least x.x

0 Karma

richgalloway
SplunkTrust
SplunkTrust

To alert on certain values, schedule a search for those values.

index=foo | rex "Took (?<num>\d+\.?\d+)ms" | where num > someThreshold | table _time hostname num

Have the search trigger an alert if the number of results is not zero.

---
If this reply helps you, Karma would be appreciated.
0 Karma

JeffCr
Explorer

Many thanks for the answer!

0 Karma

skoelpin
SplunkTrust
SplunkTrust

You would use a regular expression..

Try this

| rex (?P<Time>(?<=Took\s)\d+(?=ms))

twinspop
Influencer

This doesn't allow for decimals.

0 Karma

skoelpin
SplunkTrust
SplunkTrust

Sorry about that, try this

| rex (?P<Time>(?<=Took\s)\d+\.\d+(?=ms))

0 Karma

JeffCr
Explorer

Whats the easiest way to search the result set and then alert on a threshold value(s). Do I need to pass this into a command to build a table first?

0 Karma

skoelpin
SplunkTrust
SplunkTrust

No you don't need to do that, you can add a | where clause such as

... | where Time > 2

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...