Extract a number before a string

[Vicky84]

Completely New to regex, I have a log as below and wanted to extract the percentage i.e. "28" and then check it with threshold limit.

10A 4.5A 4.2A 28% /text/path

[MuS]

Hi Vicky84,

you can use this regex to get it:

 your base search here | rex "(?:[^\s]+\s){3}(?<perc>\d+)%" | ...

or this one:

your base search here | rex "\S+\s\S+\s\S+\s(?<perc>\d+)%" | ...

The first regex matches three times everything that is not a whitespace followed by a whitespace and take all digits in to the field called perc.
the second regex matches any non-whitespace character followed by one space followed by any non-whitespace character followed by one space any non-whitespace character followed by one space and take all digits in to the field called perc.

Hope this helps and checkout the web page regex101.com which provides good examples and helps to learn regex 😉

cheers, MuS

[khaynes_splunk]

If you use the Field Extraction tool built into Splunk, you will not need to build the regex yourself. When viewing such an event in Splunk, open the event by clicking the ">" carat to the left of the event, then click the Event Actions button, then click Extract Fields. This will take you to the Extract Fields wizard where you just highlight the text you want to extract and give the field a name...