How to apply alert based on search in Splunk?

[Splunkstart]

Hi All,

these are the logger info counts which are generated in splunk 

Total numner where inds-a 20
Total numner where inds-b 30
Total numner where inds-c 40
Total numner where inds-d 50

i need to create a alert based on inds-c percentage

if inds-c is greater than 10% it should create a alert

below is the search query i am trying but it has some issue with the rex part ,any suggestions

index=abc log_severity=INFO OR WARN appname=doc
country=ind earlies=@d
|rex "Total Number where inds-c (?<counts>\d+)"
|rex "Total Number where inds-* (?<Allcounts>\d+)"
eval percentage=((counts/Allcounts)*100)
where percentage>=10

[ITWhisperer]

* in regex means zero or more repetitions of the previous item so your expression is looking for inds-, or inds-- etc. Use . for any character.

|rex "Total Number where inds-. (?<Allcounts>\d+)"

[Splunkstart]

this was helpful 

thankyou

[gcusello · Accepted solution]

Hi @Splunkstart,

at first the main search is wrong and the approach isn't correct becuase you need to summ the values before executing the percentage, so please try something like this:

index=abc (log_severity=INFO OR log_severity=WARN)appname=doc country=ind earlies=@d
| rex "Total Number where inds-c (?<counts_c>\d+)"
| rex "Total Number where inds-* (?<Allcounts>\d+)"
| stats values(counts_c) AS counts_c sum(Allcounts) AS Allcounts 
| eval percentage=((counts_c/Allcounts)*100)
| where percentage>=10

Ciao.

Giuseppe

[Splunkstart]

sorry my requirement is 

Total number where inds I

Total numner where inds Z etc

when i  gave below rex  for all counts(removed * and gave . )

| rex total number where ind is . (?<Allcounts>\d+)

it worked