topic How to use Regex on non-uniform data in Splunk Search

How to use Regex on non-uniform data

paulito — Tue, 22 Feb 2022 16:57:06 GMT

I'm trying to extract a number that may not always be formatted the same way every time.

Examples:

OK: Process matching httpd is using 0% CPU

OK: Process matching httpd is using 1.1% CPU

OK: Process matching httpd is using 24.1% CPU

It's the "0%" that is tripping me up.

This will work for numbers with a decimal but not for a percentage that is just "0".

rex "using\s(?<CPU_util_perc>\d+.\d+)\%"

Any help is greatly appreciated.

richgalloway — Mon, 21 Feb 2022 19:16:20 GMT

Try this regex. It accepts any combination of digits and decimals.

using\s(?<CPU_util_perc>[\d\.]+)\%

You also could use

using\s(?<CPU_util_perc>.+)\%

since there's (probably) little chance of anything other than a number being in that position.

crv3347 — Mon, 21 Feb 2022 19:37:02 GMT

This worked on the sample data you provided.

using\s(?<CPU_util_perc>[0-9\.]{1,4})%

somesoni2 — Mon, 21 Feb 2022 19:37:34 GMT

Give this a try

| rex "using\s(?<CPU_util_perc>\d+(\.\d+)*)\%" OR | rex "using\s(?<CPU_util_perc>[^\%]+)\%"

paulito — Mon, 21 Feb 2022 19:40:04 GMT

They both work!

Thank you

richgalloway — Mon, 21 Feb 2022 19:45:33 GMT

If your problem is resolved, then please click one of the "Accept as Solution" buttons to help future readers.