topic Extract help... in Splunk Search

Extract help...

a212830 — Tue, 05 May 2015 18:57:39 GMT

Hi,

We log our filesystem utilization to Splunk, and I'd like to extract percentage used field, but the formats for Windows/*Nix are different. Was wondering if there are any regex experts out there that could take the two examples and create a universal regex that grabs the percent used utilization:

Nix (percentage is after "Use%")
14:42:21 05/05/2015 good 1048593817 [Linux][Baseline][SERVERA][FileSystem][/tmp] FileSystems\/tmp\Use%=1% 11:33243 0 1

Windows (percentage is after bracket and before %full):
14:56:34 05/05/2015 good 1039182967 [Windows][Baseline][ei0610vwin][DriveSpaceFree][C-MBFree] 93.414% full, 3372MB free, 51197MB total 2:251 93.414 3372

TIA...

Re: Extract help...

woodcock — Tue, 05 May 2015 19:06:11 GMT

([\d\.]*)%

Re: Extract help...

stephanefotso — Tue, 05 May 2015 21:21:07 GMT

Hello! Here is what you can do. Working both for Windows/*Nix filesystems!

.....|rex field=_raw "^[^\n]*Use\%=(?P&lt;tmpuse&gt;\d+)"|rex field=_raw "^(?:[^ \n]* ){1,8}(?P&lt;tmpuse&gt;[0-9.]+)\%\s*full"|table tmpuse

Thanks!

Re: Extract help...

a212830 — Wed, 06 May 2015 12:06:53 GMT

This gave me an error - perhaps something was translated when posting? Is there a way to make this an extract?

Re: Extract help...

stephanefotso — Mon, 28 Sep 2020 19:45:07 GMT

Here is what to type.

|rex field=_raw "^[^\n]Use\%=(?P<tmpuse>\d+)"|rex field=_raw "^(?:[^ \n] ){1,8}(?P<tmpuse>[0-9.]+)\%\s*full"|table tmpuse

Re: Extract help...

a212830 — Wed, 06 May 2015 14:21:06 GMT

Thanks, not working though. Comes back blank.

Re: Extract help...

stephanefotso — Wed, 06 May 2015 16:37:29 GMT

The problem is the text editor. replace "<" with < and ">"with > in the code bellow
...|rex field=_raw "^[^\n]Use%=(?P<tmpuse>d+)"|rex field=_raw "^(?:[^ \n] ){1,8}(?P<tmpuse>[0-9.]+)\%s*full"|table tmpuse

Re: Extract help...

a212830 — Thu, 07 May 2015 01:51:08 GMT

Tried that:

|rex field=_raw "^[^\n]Use%=(?P&lt;tmpuse&gt;d+)"|rex field=_raw "^(?:[^ \n] ){1,8}(?P&lt;tmpuse&gt;[0-9.]+)\%s*full"|table tmpuse

Doesn't work.

Re: Extract help...

stephanefotso — Thu, 07 May 2015 08:01:09 GMT

Always errors in your above code! Escape all % caracters. And put a star(*) after all "[^ \n]", and do not forget to replace "<" as mentioned earlier.
See my first query above.

Re: Extract help...

woodcock — Thu, 07 May 2015 12:29:08 GMT

Did you try mine? Here is the full search:
... | rex "(?<myPct>[\d\.]*)%" | table myPct