field extraction to value

[browniefs100]

Some of my log lines include
"20180228 034322 : [04936] License threshold of 100% reached. There are 202 of 202 licenses in use."

I want to extract the 100% as a value.
I have attempted this but my field extraction is finding occurrences of 100%.
last part of search filter is field1 = "*License threshold*"|timechart count by licthreshpercent.
Regex is ^[^\]\n]*\]\s+(?P<licthreshkey>\w+\s+\w+\s+\w+)\s+(?P<licthreshpercent>\d+).

How can I turn the "100%" into a value to chart against ?

[niketn]

@browniefs100, please try the following Regular Expression ^(?<time>[^:]+)\:\s\[(?<some_id>[^\]]+)\]\sLicense threshold of (?<threshold_percent>[^%]+)% reached\. There are (?<used_license>[^\s]+)\sof\s(?<total_license>[^\s]+)\slicenses in use\.

Following is a run anywhere search based on sample data provided:

|  makeresults
|  eval _raw="20180228 034322 : [04936] License threshold of 100% reached. There are 202 of 202 licenses in use."
|  rex "^(?<time>[^:]+)\:\s\[(?<some_id>[^\]]+)\]\sLicense threshold of (?<threshold_percent>[^%]+)% reached\. There are (?<used_license>[^\s]+)\sof\s(?<total_license>[^\s]+)\slicenses in use\."
|  eval _time=strptime(trim(time),"%Y%m%d %H%M%S")
|  timechart max(threshold_percent) as threshold_percent

[browniefs100]

Thanks I will try it.

[mayurr98]

I did not understand your question. could you pls explain with sample input and output?
As far as I understand you are able to extract it properly right? so once you extract what you want obviously it will tell you occurrences for that value. as for eg.from your entire result set if 100 comes 10 times then it will show you 10 for 100 value.

[browniefs100]

I am looking to extract the value before the '%', not look for occurences of 100% ... in order to setup a chart and alert.
I want to be able to chart the % value by time.
I hope that clarifies my question.

[mayurr98]

do you want something like this ?

| timechart values(licthreshpercent)

[browniefs100]

I had thought that was a possible solution, but when attempting to specify value (as per your example) I get no results.
Are you able to speculate why ?

[mayurr98]

can you share your entire search query?

[browniefs100]

With identifiable data removed it is:
host=<> index=<> XXid=<> sourcetype="<>" source="<>" field1="License threshold"| timechart by values(licthreshpercent)

[mayurr98]

remove by its just | timechart values(licthreshpercent)

[browniefs100]

Qh yes ... I added "by" in an attempt to get it returning data.

host=<> index=<> XXid=<> sourcetype="<>" source="<>" field1="License threshold"| timechart values(licthreshpercent)

returns "No results found. Try expanding the time range "

But using" timechart count by licthreshpercent " does give me a timechart, albeit the occurences of licthreshpercent .

[knielsen]

Does your base search return anything without the timechart?

I am just wondering, as you use field1="*License threshold*" in your search, when it is called "licthreshkey" in your field extraction.