Splunk Search

regex to find a word in a string and validate numeric value (followed by a %) is above 80%

thaghost99
Path Finder

i would like to find a query where it is looking for the word 'DISK' &  ##% is above a certain percentage.

i have the following but does not seem to work.

(\N*Disk\D*)([0-9][0-9]|\d{2,})\%

so from the example below. i should only be left with "Logging Disk Usage 85%"

example:

CPU 99%

Logging Disk Usage 85%

/VAR log  87%

Labels (1)
Tags (1)
0 Karma
1 Solution

johnhua
Builder

Try this. Accounts for 80-100%.

.*Disk\sUsage\s(([8-9]\d+)|100)\%

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Does this work for you?

.* Disk.*[8,9]\d\%
0 Karma

thaghost99
Path Finder

Hi ITWhisperer,

 

thanks for getting back.

the one you posted, does not seem to work. it seems to be looking expecifically 89% only. 

 

when i expanded your search to 

 

.* Disk.*[0-9][0-9]|\d{2,}\%

 

it picks up the correct one, but it also ignores everything else. if it finds any records matching 0-9+0-9+% it will show up.

example events: all events with underline is captuerd on above search 😞 

40%
18%
66%
CPU load 40%
cPu 40%
Logging Disk Usage 14%
Logging Disk Usage 64%
Logging Disk Usage 89%
Logging Disk Usage 4%

i want to only show the one in bold. 

0 Karma

johnhua
Builder

Try this. Accounts for 80-100%.

.*Disk\sUsage\s(([8-9]\d+)|100)\%

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...