i would like to find a query where it is looking for the word 'DISK' & ##% is above a certain percentage.
i have the following but does not seem to work.
(\N*Disk\D*)([0-9][0-9]|\d{2,})\%
so from the example below. i should only be left with "Logging Disk Usage 85%"
example:
CPU 99%
Logging Disk Usage 85%
/VAR log 87%
Does this work for you?
.* Disk.*[8,9]\d\%
Hi ITWhisperer,
thanks for getting back.
the one you posted, does not seem to work. it seems to be looking expecifically 89% only.
when i expanded your search to
.* Disk.*[0-9][0-9]|\d{2,}\%
it picks up the correct one, but it also ignores everything else. if it finds any records matching 0-9+0-9+% it will show up.
example events: all events with underline is captuerd on above search 😞
40%
18%
66%
CPU load 40%
cPu 40%
Logging Disk Usage 14%
Logging Disk Usage 64%
Logging Disk Usage 89%
Logging Disk Usage 4%
i want to only show the one in bold.
Try this. Accounts for 80-100%.
.*Disk\sUsage\s(([8-9]\d+)|100)\%