topic Re: field extraction to value in Splunk Search

field extraction to value

browniefs100 — Tue, 22 May 2018 08:48:49 GMT

Some of my log lines include
"20180228 034322 : [04936] License threshold of 100% reached. There are 202 of 202 licenses in use."

I want to extract the 100% as a value.
I have attempted this but my field extraction is finding occurrences of 100%.
last part of search filter is field1 = "*License threshold*"|timechart count by licthreshpercent.
Regex is ^[^\]\n]*\]\s+(?P<licthreshkey>\w+\s+\w+\s+\w+)\s+(?P<licthreshpercent>\d+).

How can I turn the "100%" into a value to chart against ?

Re: field extraction to value

mayurr98 — Tue, 22 May 2018 09:08:50 GMT

I did not understand your question. could you pls explain with sample input and output?
As far as I understand you are able to extract it properly right? so once you extract what you want obviously it will tell you occurrences for that value. as for eg.from your entire result set if 100 comes 10 times then it will show you 10 for 100 value.

Re: field extraction to value

browniefs100 — Tue, 22 May 2018 09:15:21 GMT

I am looking to extract the value before the '%', not look for occurences of 100% ... in order to setup a chart and alert.
I want to be able to chart the % value by time.
I hope that clarifies my question.

Re: field extraction to value

mayurr98 — Tue, 22 May 2018 09:24:29 GMT

do you want something like this ?

| timechart values(licthreshpercent)

Re: field extraction to value

browniefs100 — Tue, 22 May 2018 09:32:58 GMT

I had thought that was a possible solution, but when attempting to specify value (as per your example) I get no results.
Are you able to speculate why ?

Re: field extraction to value

mayurr98 — Tue, 22 May 2018 09:36:54 GMT

can you share your entire search query?

Re: field extraction to value

browniefs100 — Tue, 22 May 2018 09:43:08 GMT

With identifiable data removed it is:
host=<> index=<> XXid=<> sourcetype="<>" source="<>" field1="License threshold"| timechart by values(licthreshpercent)

Re: field extraction to value

mayurr98 — Tue, 22 May 2018 10:10:18 GMT

remove by its just | timechart values(licthreshpercent)

Re: field extraction to value

browniefs100 — Tue, 22 May 2018 10:33:13 GMT

Qh yes ... I added "by" in an attempt to get it returning data.

host=<> index=<> XXid=<> sourcetype="<>" source="<>" field1="License threshold"| timechart values(licthreshpercent)

returns "No results found. Try expanding the time range "

But using" timechart count by licthreshpercent " does give me a timechart, albeit the occurences of licthreshpercent .

Re: field extraction to value

knielsen — Tue, 22 May 2018 12:32:26 GMT

Does your base search return anything without the timechart?

I am just wondering, as you use field1="*License threshold*" in your search, when it is called "licthreshkey" in your field extraction.

Re: field extraction to value

niketn — Tue, 22 May 2018 13:48:13 GMT

@browniefs100, please try the following Regular Expression ^(?<time>[^:]+)\:\s\[(?<some_id>[^\]]+)\]\sLicense threshold of (?<threshold_percent>[^%]+)% reached\. There are (?<used_license>[^\s]+)\sof\s(?<total_license>[^\s]+)\slicenses in use\.

Following is a run anywhere search based on sample data provided:

|  makeresults
|  eval _raw="20180228 034322 : [04936] License threshold of 100% reached. There are 202 of 202 licenses in use."
|  rex "^(?<time>[^:]+)\:\s\[(?<some_id>[^\]]+)\]\sLicense threshold of (?<threshold_percent>[^%]+)% reached\. There are (?<used_license>[^\s]+)\sof\s(?<total_license>[^\s]+)\slicenses in use\."
|  eval _time=strptime(trim(time),"%Y%m%d %H%M%S")
|  timechart max(threshold_percent) as threshold_percent

Re: field extraction to value

browniefs100 — Wed, 23 May 2018 07:50:05 GMT

Thanks I will try it.