Splunk Search

regex to find a word in a string and validate numeric value (followed by a %) is above 80%

thaghost99
Path Finder

i would like to find a query where it is looking for the word 'DISK' &  ##% is above a certain percentage.

i have the following but does not seem to work.

(\N*Disk\D*)([0-9][0-9]|\d{2,})\%

so from the example below. i should only be left with "Logging Disk Usage 85%"

example:

CPU 99%

Logging Disk Usage 85%

/VAR log  87%

Labels (1)
Tags (1)
0 Karma
1 Solution

johnhuang
Motivator

Try this. Accounts for 80-100%.

.*Disk\sUsage\s(([8-9]\d+)|100)\%

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Does this work for you?

.* Disk.*[8,9]\d\%
0 Karma

thaghost99
Path Finder

Hi ITWhisperer,

 

thanks for getting back.

the one you posted, does not seem to work. it seems to be looking expecifically 89% only. 

 

when i expanded your search to 

 

.* Disk.*[0-9][0-9]|\d{2,}\%

 

it picks up the correct one, but it also ignores everything else. if it finds any records matching 0-9+0-9+% it will show up.

example events: all events with underline is captuerd on above search 😞 

40%
18%
66%
CPU load 40%
cPu 40%
Logging Disk Usage 14%
Logging Disk Usage 64%
Logging Disk Usage 89%
Logging Disk Usage 4%

i want to only show the one in bold. 

0 Karma

johnhuang
Motivator

Try this. Accounts for 80-100%.

.*Disk\sUsage\s(([8-9]\d+)|100)\%

0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...