Splunk Search

Extract a number before a string

Vicky84
Explorer

Completely New to regex, I have a log as below and wanted to extract the percentage i.e. "28" and then check it with threshold limit.

10A 4.5A 4.2A 28% /text/path

0 Karma

MuS
Legend

Hi Vicky84,

you can use this regex to get it:

 your base search here | rex "(?:[^\s]+\s){3}(?<perc>\d+)%" | ...

or this one:

your base search here | rex "\S+\s\S+\s\S+\s(?<perc>\d+)%" | ...

The first regex matches three times everything that is not a whitespace followed by a whitespace and take all digits in to the field called perc.
the second regex matches any non-whitespace character followed by one space followed by any non-whitespace character followed by one space any non-whitespace character followed by one space and take all digits in to the field called perc.

Hope this helps and checkout the web page regex101.com which provides good examples and helps to learn regex 😉

cheers, MuS

0 Karma

khaynes_splunk
Splunk Employee
Splunk Employee

If you use the Field Extraction tool built into Splunk, you will not need to build the regex yourself. When viewing such an event in Splunk, open the event by clicking the ">" carat to the left of the event, then click the Event Actions button, then click Extract Fields. This will take you to the Extract Fields wizard where you just highlight the text you want to extract and give the field a name...

0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...