I have the following event and I'm trying to pull out the last occurrence of the service_x call. I've named them service_x because I won't know how many services get called within the event. But in this example, I would like "service_9" to be returned so that I can build a table on it. Is there a way to do that?
Thrift: [service_1: (74.400232 ms)|service_2: (202.680038 ms)|service_3: (165.498747 ms)|service_4: (184.461466 ms)|service_5: (298.359583 ms)|service_6: (525.498376 ms)|service_7: (737.382805 ms)|service_8: (709.533687 ms)|service_9: (8960.064359 ms)])
rweldy,
This should get you the last service every time:
(?<=\|)(?<last_service>\w+)(?=:\s+\(\d+.\d+\s+ms\)\]\)$)
rweldy,
This should get you the last service every time:
(?<=\|)(?<last_service>\w+)(?=:\s+\(\d+.\d+\s+ms\)\]\)$)
Thank you, exactly what I needed!
You're welcome! Glad it worked for you!
How about trying this:
your query to return events
| rex field=_raw "\|(?<lastServiceName>[^\:]+)\:\s+\((?<timeInMs>\d+\.\d+)\sms\)\]\)$"
| table lastServiceName, timeInMs
Thank you, this worked out well too!
Try this
UPDATED
.... | rex "\|(?<last_service>[\w\d]+):\s\((?<time>\d+\.\d+)\sms\)\]\)$"
Thanks for the response, but looks like that pulls out the time in ms. I'm looking to pull out the actual service name like "service_9". I may be able to use this to get a little closer though.
Misunderstood. The updated includes service name as well.