Splunk Search

How to compare numbers before and after a special char?

HelloItsMe76
Explorer

Hello, 

I have a log file that spits out data like the below. I want to be able to evaluate the the numbers either side of the "/" and alert if they are not the same. How can i do this? The will only be 1 "/" per line. The last line below that has "1/3" would be the only line i want returning. 

The data below is not in table form in the log file, its just text.  

 

NAME READY STATUS RESTARTS AGE

Process1 2/2 Running 0 8d

Process2ab  2/2 Running 0 8d

Process 3abc  1/3 Running 0 8d

 

Labels (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

There probably are a few ways to do that.  Here's one.

<<your search>>
| rex "\s(?<a>\d+)\/(?<b>\d+)"
| where a!=b
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...