Splunk Search

regex to find a word in a string and validate numeric value (followed by a %) is above 80%

thaghost99
Path Finder

i would like to find a query where it is looking for the word 'DISK' &  ##% is above a certain percentage.

i have the following but does not seem to work.

(\N*Disk\D*)([0-9][0-9]|\d{2,})\%

so from the example below. i should only be left with "Logging Disk Usage 85%"

example:

CPU 99%

Logging Disk Usage 85%

/VAR log  87%

Labels (1)
Tags (1)
0 Karma
1 Solution

johnhuang
Motivator

Try this. Accounts for 80-100%.

.*Disk\sUsage\s(([8-9]\d+)|100)\%

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Does this work for you?

.* Disk.*[8,9]\d\%
0 Karma

thaghost99
Path Finder

Hi ITWhisperer,

 

thanks for getting back.

the one you posted, does not seem to work. it seems to be looking expecifically 89% only. 

 

when i expanded your search to 

 

.* Disk.*[0-9][0-9]|\d{2,}\%

 

it picks up the correct one, but it also ignores everything else. if it finds any records matching 0-9+0-9+% it will show up.

example events: all events with underline is captuerd on above search 😞 

40%
18%
66%
CPU load 40%
cPu 40%
Logging Disk Usage 14%
Logging Disk Usage 64%
Logging Disk Usage 89%
Logging Disk Usage 4%

i want to only show the one in bold. 

0 Karma

johnhuang
Motivator

Try this. Accounts for 80-100%.

.*Disk\sUsage\s(([8-9]\d+)|100)\%

0 Karma
Get Updates on the Splunk Community!

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...

Splunk MCP & Agentic AI: Machine Data Without Limits

Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization uses ...