Hi,
We log our filesystem utilization to Splunk, and I'd like to extract percentage used field, but the formats for Windows/*Nix are different. Was wondering if there are any regex experts out there that could take the two examples and create a universal regex that grabs the percent used utilization:
Nix (percentage is after "Use%")
14:42:21 05/05/2015 good 1048593817 [Linux][Baseline][SERVERA][FileSystem][/tmp] FileSystems\/tmp\Use%=1% 11:33243 0 1
Windows (percentage is after bracket and before %full):
14:56:34 05/05/2015 good 1039182967 [Windows][Baseline][ei0610vwin][DriveSpaceFree][C-MBFree] 93.414% full, 3372MB free, 51197MB total 2:251 93.414 3372
TIA...
Hello! Here is what you can do. Working both for Windows/*Nix filesystems!
.....|rex field=_raw "^[^\n]*Use\%=(?P<tmpuse>\d+)"|rex field=_raw "^(?:[^ \n]* ){1,8}(?P<tmpuse>[0-9.]+)\%\s*full"|table tmpuse
Thanks!
This gave me an error - perhaps something was translated when posting? Is there a way to make this an extract?
Here is what to type.
|rex field=_raw "^[^\n]Use\%=(?P<tmpuse>\d+)"|rex field=_raw "^(?:[^ \n] ){1,8}(?P<tmpuse>[0-9.]+)\%\s*full"|table tmpuse
Thanks, not working though. Comes back blank.
The problem is the text editor. replace "<"
with < and ">"
with > in the code bellow
...|rex field=_raw "^[^\n]Use%=(?P<tmpuse>d+)"|rex field=_raw "^(?:[^ \n] ){1,8}(?P<tmpuse>[0-9.]+)\%s*full"|table tmpuse
Tried that:
|rex field=_raw "^[^\n]Use%=(?P<tmpuse>d+)"|rex field=_raw "^(?:[^ \n] ){1,8}(?P<tmpuse>[0-9.]+)\%s*full"|table tmpuse
Doesn't work.
Always errors in your above code! Escape all % caracters. And put a star(*) after all "[^ \n]"
, and do not forget to replace "<"
as mentioned earlier.
See my first query above.
([\d\.]*)%
Did you try mine? Here is the full search:
... | rex "(?<myPct>[\d\.]*)%" | table myPct