topic Percentage in range - numeric search? in Splunk Search

Percentage in range - numeric search?

timbCFCA — Wed, 28 May 2014 13:32:59 GMT

I have a field extraction that comes back with the literal values of 'X%'. Note that the % is part of the value returned. I now need to do searches based on the range of the value of the loss field.

index=* ping sprint-uplink ( loss>0% AND loss<100% )

Is there a good native way to do this or do I need to eval / regex out the numerical values?

Re: Percentage in range - numeric search?

aholzer — Wed, 28 May 2014 14:02:59 GMT

I'd suggest changing your field extraction to only extract the numeric value, rather than include the '%' and forcing it to act as a string.

This way you could simply run something similar to your search with: (loss>0 AND loss<100)

Otherwise you are going to need an eval to get a substring, or a rex on field loss ( rex field=loss "(?<loss_num>[^\%]*)\%" ), combined with a search command ( search (loss_num>0 AND loss_num<100) )

If you don't change the extraction, your search will look something like this:

index=* ping sprint-uplink | rex field=loss "(?<loss_num>[^\%]*)\%" | search loss_num>0 AND loss_num<100

Re: Percentage in range - numeric search?

richgalloway — Wed, 28 May 2014 14:19:54 GMT

I'm tempted to suggest something like (loss>'0%' AND lost<'100%'), but am not sure you can compare strings like that. I think you'll need to extract the numeric value. Have a look at convert().

Re: Percentage in range - numeric search?

timbCFCA — Wed, 28 May 2014 14:22:31 GMT

I thought about it, but others of my searches depend on it having the percent sign included.. Modifying isn't feasible. The rex you provided is nearly identical to what I use, except I use '\d+'. I was mostly hoping for a native way to handle this kind of conversion.

Re: Percentage in range - numeric search?

timbCFCA — Wed, 28 May 2014 14:29:16 GMT

The convert function is a whole lot cleaner compared to my initial idea of using a regex. Thanks!