MS SQL ErrorLogs search for string with value after word.

[tbradey]

MS SQL ErrorLog have a single line with the following format "Date Time Error: ####, Severity: ##, State: #"

I require a search to find any error with the Severity: grater than 16.

Examples which should come back:

2012-12-03 19:00:30.86 spid29s Error: 1474, Severity: 16, State: 1.
2012-12-03 19:00:30.86 spid29s Error: 1474, Severity: 18, State: 1.
2012-12-03 19:00:30.86 spid29s Error: 1474, Severity: 24, State: 1.

Examples to be ignored:
2012-12-03 19:00:32.72 Logon Error: 18456, Severity: 14, State: 38.

I'm new to splunk searches, should I be looking at rex for a solution here?

[dart]

You need a field extraction to do your search, if you select "Extract Fields" from the dropdown next to the events when you run a search, you should be able to feed in the example severities, and Splunk should make a regex for you, which you can then save and use in a search like so:
sourcetype=my_sql_error_log_sourcetype severity>16

You may also be interested in the TA for MS SQL Server 2012