The Log output is below:
Need to search if Port 2003 farm total < 21
6/6/17
3:35:01.000 PM
Tue Jun 6 15:35:01 EDT 2017
Port 2003 = PLD
Port 2004 = CC
Port 2005 = Settlement
Port 2003 farm total = 21
dukerwpv01_2003 = 6
dukerwpv02_2003 = 15
dukerwpv03_2003 = 0
Port 2004 farm total = 21
dukerwpv01_2004 = 1
dukerwpv02_2004 = 6
dukerwpv03_2004 = 14
Port 2005 farm total = 40
dukerwpv01_2005 = 11
dukerwpv02_2005 = 17
dukerwpv03_2005 = 12
Thanks woodcock and cmerriman.. both answers worked.
Like this:
index=YourIndexHere sourcetype=YourSourcetypeHere Port 2003 farm total
| rex "Port 2003 farm total\s*=\s*(?<port2003farmtotal>\d+)"
| search port2003farmtotal<21
maybe something like this if you don't have that field extracted yet, otherwise if you do, you should just need the search:
rex "Port 2003 farm total = (?<port2003farmtotal>\d+)"|search port2003farmtotal<21