Extracting number from a string in order to use stats command. Regex?

[paulito]

Data:

SERVICEPERFDATA::'total 120m'=8%;95;97 SERVICECHECKCOMMAND::check_nrpe3!check_cpu!-a!"warn=load > 95" "crit=load > 97" "time=120m"!"detail-syntax=%(load)% load for %(time) - Thresholds: Warn gt 95%, Crit gt 97%"!show-all!!! HOSTSTATE::UP HOSTSTATETYPE::HARD SERVICESTATE::OK SERVICESTATETYPE::HARD SERVICEOUTPUT::OK: 8% load for 120m - Thresholds: Warn gt 95%, Crit gt 97%

I just need one of the "8%" to be extracted as a number so I can see the average over time for example.

Am I correct in thinking regex can do this?

[MuS · Accepted solution]

Hi there,

if the format of the string is always the same you can use rex to get the first 8 like this

| makeresults 
| eval foo="SERVICEPERFDATA::'total 120m'=8%;95;97 SERVICECHECKCOMMAND::check_nrpe3!check_cpu!-a!\"warn=load > 95\" \"crit=load \> 97\" \"time=120m\"!\"detail-syntax=%(load)% load for %(time) - Thresholds: Warn gt 95%, Crit gt 97%\"!show-all!!! HOSTSTATE::UP HOSTSTATETYPE::HARD SERVICESTATE::OK SERVICESTATETYPE::HARD SERVICEOUTPUT::OK: 8% load for 120m - Thresholds: Warn gt 95%, Crit gt 97%" 
| makemv delim="X" foo 
| mvexpand foo `comment("Anything above is to generate events")`
| rex field=foo "\dm\'=(?<perc>\d)\%"

cheers, MuS 

[paulito]

Thank you so much, that last line works perfectly. 

Can I ask if this will capture a multiple digit number?

[MuS]

Hi there,

for multiples digits you have to add a + like this:

| rex field=foo "\dm\'=(?<perc>\d+)\%"

cheers, MuS