Splunk Search

field extraction to value

New Member

Some of my log lines include
"20180228 034322 : [04936] License threshold of 100% reached. There are 202 of 202 licenses in use."

I want to extract the 100% as a value.
I have attempted this but my field extraction is finding occurrences of 100%.
last part of search filter is field1 = "*License threshold*"|timechart count by licthreshpercent.
Regex is ^[^\]\n]*\]\s+(?P<licthreshkey>\w+\s+\w+\s+\w+)\s+(?P<licthreshpercent>\d+).

How can I turn the "100%" into a value to chart against ?

Tags (3)
0 Karma

SplunkTrust
SplunkTrust

@browniefs100, please try the following Regular Expression ^(?<time>[^:]+)\:\s\[(?<some_id>[^\]]+)\]\sLicense threshold of (?<threshold_percent>[^%]+)% reached\. There are (?<used_license>[^\s]+)\sof\s(?<total_license>[^\s]+)\slicenses in use\.

Following is a run anywhere search based on sample data provided:

|  makeresults
|  eval _raw="20180228 034322 : [04936] License threshold of 100% reached. There are 202 of 202 licenses in use."
|  rex "^(?<time>[^:]+)\:\s\[(?<some_id>[^\]]+)\]\sLicense threshold of (?<threshold_percent>[^%]+)% reached\. There are (?<used_license>[^\s]+)\sof\s(?<total_license>[^\s]+)\slicenses in use\."
|  eval _time=strptime(trim(time),"%Y%m%d %H%M%S")
|  timechart max(threshold_percent) as threshold_percent
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

New Member

Thanks I will try it.

0 Karma

SplunkTrust
SplunkTrust

I did not understand your question. could you pls explain with sample input and output?
As far as I understand you are able to extract it properly right? so once you extract what you want obviously it will tell you occurrences for that value. as for eg.from your entire result set if 100 comes 10 times then it will show you 10 for 100 value.

0 Karma

New Member

I am looking to extract the value before the '%', not look for occurences of 100% ... in order to setup a chart and alert.
I want to be able to chart the % value by time.
I hope that clarifies my question.

0 Karma

SplunkTrust
SplunkTrust

do you want something like this ?

| timechart values(licthreshpercent)
0 Karma

New Member

I had thought that was a possible solution, but when attempting to specify value (as per your example) I get no results.
Are you able to speculate why ?

0 Karma

SplunkTrust
SplunkTrust

can you share your entire search query?

0 Karma

New Member

With identifiable data removed it is:
host=<> index=<> XXid=<> sourcetype="<>" source="<>" field1="License threshold"| timechart by values(licthreshpercent)

0 Karma

SplunkTrust
SplunkTrust

remove by its just | timechart values(licthreshpercent)

0 Karma

New Member

Qh yes ... I added "by" in an attempt to get it returning data.

host=<> index=<> XXid=<> sourcetype="<>" source="<>" field1="License threshold"| timechart values(licthreshpercent)

returns "No results found. Try expanding the time range "

But using" timechart count by licthreshpercent " does give me a timechart, albeit the occurences of licthreshpercent .

0 Karma

Contributor

Does your base search return anything without the timechart?

I am just wondering, as you use field1="*License threshold*" in your search, when it is called "licthreshkey" in your field extraction.

0 Karma