topic Re: regex to find a word in a string and validate numeric value (followed by a %) is above 80% in Splunk Search

regex to find a word in a string and validate numeric value (followed by a %) is above 80%

thaghost99 — Wed, 26 Jan 2022 22:09:49 GMT

i would like to find a query where it is looking for the word 'DISK' & ##% is above a certain percentage.

i have the following but does not seem to work.

(\N*Disk\D*)([0-9][0-9]|\d{2,})\%

so from the example below. i should only be left with "Logging Disk Usage 85%"

example:

CPU 99%

Logging Disk Usage 85%

/VAR log 87%

ITWhisperer — Wed, 26 Jan 2022 23:13:40 GMT

Does this work for you?

.* Disk.*[8,9]\d\%

thaghost99 — Wed, 26 Jan 2022 23:31:31 GMT

Hi ITWhisperer,

thanks for getting back.

the one you posted, does not seem to work. it seems to be looking expecifically 89% only.

when i expanded your search to

.* Disk.*[0-9][0-9]|\d{2,}\%

it picks up the correct one, but it also ignores everything else. if it finds any records matching 0-9+0-9+% it will show up.

example events: all events with underline is captuerd on above search 😞

40%
18%
66%
CPU load 40%
cPu 40%
Logging Disk Usage 14%
Logging Disk Usage 64%
Logging Disk Usage 89%
Logging Disk Usage 4%

i want to only show the one in bold.

johnhuang — Thu, 27 Jan 2022 01:04:56 GMT

Try this. Accounts for 80-100%.

.*Disk\sUsage\s(([8-9]\d+)|100)\%