Splunk Search

regex to find a word in a string and validate numeric value (followed by a %) is above 80%

thaghost99
Path Finder

i would like to find a query where it is looking for the word 'DISK' &  ##% is above a certain percentage.

i have the following but does not seem to work.

(\N*Disk\D*)([0-9][0-9]|\d{2,})\%

so from the example below. i should only be left with "Logging Disk Usage 85%"

example:

CPU 99%

Logging Disk Usage 85%

/VAR log  87%

Labels (1)
Tags (1)
0 Karma
1 Solution

johnhuang
Motivator

Try this. Accounts for 80-100%.

.*Disk\sUsage\s(([8-9]\d+)|100)\%

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Does this work for you?

.* Disk.*[8,9]\d\%
0 Karma

thaghost99
Path Finder

Hi ITWhisperer,

 

thanks for getting back.

the one you posted, does not seem to work. it seems to be looking expecifically 89% only. 

 

when i expanded your search to 

 

.* Disk.*[0-9][0-9]|\d{2,}\%

 

it picks up the correct one, but it also ignores everything else. if it finds any records matching 0-9+0-9+% it will show up.

example events: all events with underline is captuerd on above search 😞 

40%
18%
66%
CPU load 40%
cPu 40%
Logging Disk Usage 14%
Logging Disk Usage 64%
Logging Disk Usage 89%
Logging Disk Usage 4%

i want to only show the one in bold. 

0 Karma

johnhuang
Motivator

Try this. Accounts for 80-100%.

.*Disk\sUsage\s(([8-9]\d+)|100)\%

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...