带条件的 splunk 正则表达式

Question

I have splunk query using which i want to filter out the log which has time greater than 100 or any number.

2015-09-04 14:31:55.015 INFO : [org.perf4j.TimingLogger:426] - start[1441402314909] time[103] tag[getDetails]
2015-09-04 14:31:56.437 INFO : [org.perf4j.TimingLogger:426] - start[1441402316435] time[12] tag[getDetails]
2015-09-04 14:31:57.654 INFO : [org.perf4j.TimingLogger:426] - start[1441402317653] time[20] tag[getDetails]
2015-09-04 14:31:58.721 INFO : [org.perf4j.TimingLogger:426] - start[1441402318720] time[10] tag[getDetails]

Here is my spunk regex. This could filter outs above 4 line from my log but I'm unable to put the condition further (greater than ). Tried eval but couldn't get the intended result.

sourcetype="abc" *|regex _raw=time\[(\d+)\]

Answer 1

If the value you want to filter out is greater than or equal to 100 then check for 3 digits:

sourcetype="abc" *|regex _raw=time\[(\d{3})\]

This way only values of 100 or higher will match.

EDIT : If you're looking for a number above a range (eg. 60 ):

sourcetype="abc" *|regex _raw=time\[([6-9]\d|\d{3,})\]

For a specific number and above (eg. 33+ ):

sourcetype="abc" *|regex _raw=time\[(33|[3-9][3-9]|[4-9]\d+|[1-9][0-9]\d+)\]

To disallow numbers with leading zeros:

sourcetype="abc" *|regex _raw=time\[(33|[3-9][3-9]|[4-9]\d+|[1-9][0-9]\d+|[1-9]\d{2,})\]