Splunk Search

regex to find a word in a string and validate numeric value (followed by a %) is above 80%

thaghost99
Path Finder

i would like to find a query where it is looking for the word 'DISK' &  ##% is above a certain percentage.

i have the following but does not seem to work.

(\N*Disk\D*)([0-9][0-9]|\d{2,})\%

so from the example below. i should only be left with "Logging Disk Usage 85%"

example:

CPU 99%

Logging Disk Usage 85%

/VAR log  87%

Labels (1)
Tags (1)
0 Karma
1 Solution

johnhuang
Motivator

Try this. Accounts for 80-100%.

.*Disk\sUsage\s(([8-9]\d+)|100)\%

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Does this work for you?

.* Disk.*[8,9]\d\%
0 Karma

thaghost99
Path Finder

Hi ITWhisperer,

 

thanks for getting back.

the one you posted, does not seem to work. it seems to be looking expecifically 89% only. 

 

when i expanded your search to 

 

.* Disk.*[0-9][0-9]|\d{2,}\%

 

it picks up the correct one, but it also ignores everything else. if it finds any records matching 0-9+0-9+% it will show up.

example events: all events with underline is captuerd on above search 😞 

40%
18%
66%
CPU load 40%
cPu 40%
Logging Disk Usage 14%
Logging Disk Usage 64%
Logging Disk Usage 89%
Logging Disk Usage 4%

i want to only show the one in bold. 

0 Karma

johnhuang
Motivator

Try this. Accounts for 80-100%.

.*Disk\sUsage\s(([8-9]\d+)|100)\%

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...