Hi,
I have a log statement that prints service execution time like -
Service Response : {"entity":"{\"transactionId\":\"39182d7a-7f34-4c28-a0f2-9b42b9b206df\",\"executionTimeInMillis\":112,"status":201}
I am trying to extract the value of "executionTimeInMillis".
My search statement - index="xyz" "Service Response :" | search "\"executionTimeInMillis\"\":"(?exeTime[^\$]*)," | table _time, exeTime
Note: I have added <> to exeTime. It is not showing in the question.
However, it did not show any results. Can you help me with this query?
The field extraction command is rex
, not search
. There may be few issues with your regex, e.g. there is no double quotes after colon. So try this
index="xyz" "Service Response :" | rex "\"executionTimeInMillis[^\:]+\:\s*(?<exeTime>[^,]+)" | table _time, exeTime
The field extraction command is rex
, not search
. There may be few issues with your regex, e.g. there is no double quotes after colon. So try this
index="xyz" "Service Response :" | rex "\"executionTimeInMillis[^\:]+\:\s*(?<exeTime>[^,]+)" | table _time, exeTime
Thank you so much. It worked. Appreciate your help.