topic Re: Extracting number from a string in order to use stats command. Regex? in Splunk Search

Extracting number from a string in order to use stats command. Regex?

paulito — Fri, 04 Feb 2022 19:34:10 GMT

Data:

SERVICEPERFDATA::'total 120m'=8%;95;97 SERVICECHECKCOMMAND::check_nrpe3!check_cpu!-a!"warn=load > 95" "crit=load > 97" "time=120m"!"detail-syntax=%(load)% load for %(time) - Thresholds: Warn gt 95%, Crit gt 97%"!show-all!!! HOSTSTATE::UP HOSTSTATETYPE::HARD SERVICESTATE::OK SERVICESTATETYPE::HARD SERVICEOUTPUT::OK: 8% load for 120m - Thresholds: Warn gt 95%, Crit gt 97%

I just need one of the "8%" to be extracted as a number so I can see the average over time for example.

Am I correct in thinking regex can do this?

Re: Extracting number from a string in order to use stats command. Regex?

MuS — Fri, 04 Feb 2022 22:54:12 GMT

Hi there,

if the format of the string is always the same you can use rex to get the first 8 like this

| makeresults | eval foo="SERVICEPERFDATA::'total 120m'=8%;95;97 SERVICECHECKCOMMAND::check_nrpe3!check_cpu!-a!\"warn=load > 95\" \"crit=load \> 97\" \"time=120m\"!\"detail-syntax=%(load)% load for %(time) - Thresholds: Warn gt 95%, Crit gt 97%\"!show-all!!! HOSTSTATE::UP HOSTSTATETYPE::HARD SERVICESTATE::OK SERVICESTATETYPE::HARD SERVICEOUTPUT::OK: 8% load for 120m - Thresholds: Warn gt 95%, Crit gt 97%" | makemv delim="X" foo | mvexpand foo `comment("Anything above is to generate events")` | rex field=foo "\dm\'=(?<perc>\d)\%"

cheers, MuS

Re: Extracting number from a string in order to use stats command. Regex?

paulito — Mon, 07 Feb 2022 16:11:22 GMT

Thank you so much, that last line works perfectly.

Can I ask if this will capture a multiple digit number?

Re: Extracting number from a string in order to use stats command. Regex?

MuS — Mon, 07 Feb 2022 19:25:45 GMT

Hi there,

for multiples digits you have to add a + like this:

| rex field=foo "\dm\'=(?<perc>\d+)\%"

cheers, MuS