Splunk Search

Percentage in range - numeric search?

timbCFCA
Path Finder

I have a field extraction that comes back with the literal values of 'X%'. Note that the % is part of the value returned. I now need to do searches based on the range of the value of the loss field.

index=* ping sprint-uplink ( loss>0% AND loss<100% )

Is there a good native way to do this or do I need to eval / regex out the numerical values?

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

I'm tempted to suggest something like (loss>'0%' AND lost<'100%'), but am not sure you can compare strings like that. I think you'll need to extract the numeric value. Have a look at convert().

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

I'm tempted to suggest something like (loss>'0%' AND lost<'100%'), but am not sure you can compare strings like that. I think you'll need to extract the numeric value. Have a look at convert().

---
If this reply helps you, Karma would be appreciated.

timbCFCA
Path Finder

The convert function is a whole lot cleaner compared to my initial idea of using a regex. Thanks!

0 Karma

aholzer
Motivator

I'd suggest changing your field extraction to only extract the numeric value, rather than include the '%' and forcing it to act as a string.

This way you could simply run something similar to your search with: (loss>0 AND loss<100)

Otherwise you are going to need an eval to get a substring, or a rex on field loss ( rex field=loss "(?<loss_num>[^\%]*)\%" ), combined with a search command ( search (loss_num>0 AND loss_num<100) )

If you don't change the extraction, your search will look something like this:

index=* ping sprint-uplink | rex field=loss "(?<loss_num>[^\%]*)\%" | search loss_num>0 AND loss_num<100

timbCFCA
Path Finder

I thought about it, but others of my searches depend on it having the percent sign included.. Modifying isn't feasible. The rex you provided is nearly identical to what I use, except I use '\d+'. I was mostly hoping for a native way to handle this kind of conversion.

0 Karma
Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...