Data:
SERVICEPERFDATA::'total 120m'=8%;95;97 SERVICECHECKCOMMAND::check_nrpe3!check_cpu!-a!"warn=load > 95" "crit=load > 97" "time=120m"!"detail-syntax=%(load)% load for %(time) - Thresholds: Warn gt 95%, Crit gt 97%"!show-all!!! HOSTSTATE::UP HOSTSTATETYPE::HARD SERVICESTATE::OK SERVICESTATETYPE::HARD SERVICEOUTPUT::OK: 8% load for 120m - Thresholds: Warn gt 95%, Crit gt 97%
I just need one of the "8%" to be extracted as a number so I can see the average over time for example.
Am I correct in thinking regex can do this?
Hi there,
if the format of the string is always the same you can use rex to get the first 8 like this
| makeresults
| eval foo="SERVICEPERFDATA::'total 120m'=8%;95;97 SERVICECHECKCOMMAND::check_nrpe3!check_cpu!-a!\"warn=load > 95\" \"crit=load \> 97\" \"time=120m\"!\"detail-syntax=%(load)% load for %(time) - Thresholds: Warn gt 95%, Crit gt 97%\"!show-all!!! HOSTSTATE::UP HOSTSTATETYPE::HARD SERVICESTATE::OK SERVICESTATETYPE::HARD SERVICEOUTPUT::OK: 8% load for 120m - Thresholds: Warn gt 95%, Crit gt 97%"
| makemv delim="X" foo
| mvexpand foo `comment("Anything above is to generate events")`
| rex field=foo "\dm\'=(?<perc>\d)\%"
cheers, MuS
Hi there,
if the format of the string is always the same you can use rex to get the first 8 like this
| makeresults
| eval foo="SERVICEPERFDATA::'total 120m'=8%;95;97 SERVICECHECKCOMMAND::check_nrpe3!check_cpu!-a!\"warn=load > 95\" \"crit=load \> 97\" \"time=120m\"!\"detail-syntax=%(load)% load for %(time) - Thresholds: Warn gt 95%, Crit gt 97%\"!show-all!!! HOSTSTATE::UP HOSTSTATETYPE::HARD SERVICESTATE::OK SERVICESTATETYPE::HARD SERVICEOUTPUT::OK: 8% load for 120m - Thresholds: Warn gt 95%, Crit gt 97%"
| makemv delim="X" foo
| mvexpand foo `comment("Anything above is to generate events")`
| rex field=foo "\dm\'=(?<perc>\d)\%"
cheers, MuS
Thank you so much, that last line works perfectly.
Can I ask if this will capture a multiple digit number?
Hi there,
for multiples digits you have to add a + like this:
| rex field=foo "\dm\'=(?<perc>\d+)\%"
cheers, MuS