https://community.splunk.com/t5/Splunk-Search/RegEx-for-the-free-m-command-Linux/m-p/176200#M50596 <P>Perfect!! Thank you!</P> Fri, 08 Aug 2014 18:09:05 GMT aferone 2014-08-08T18:09:05Z https://community.splunk.com/t5/Splunk-Search/RegEx-for-the-free-m-command-Linux/m-p/176198#M50594 <P>I have a script that runs the "free -m" command, and I am only pulling (grepping) the lines like the following:</P> <PRE><CODE>-/+ buffers/cache: 219 1789 -/+ buffers/cache: 1469 10557 </CODE></PRE> <P>The first value is used memory, and the second value is free memory. </P> <P>The RegEx for free memory works for all of the logs:</P> <PRE><CODE>(?i)^[^:]*:\s+\d+\s+(?P&lt;FreeMemory&gt;.+) </CODE></PRE> <P>However, for used memory, the following RegEx only works for the 2nd log line above, because of the amount of spaces between "cache:" and the value.</P> <PRE><CODE>(?i)/cache: (?P&lt;UsedMemory&gt;[^ ]+) </CODE></PRE> <P>How do I get the RegEx to work, regardless of how many spaces are in between?</P> <P>Thanks!</P> Fri, 08 Aug 2014 14:07:10 GMT https://community.splunk.com/t5/Splunk-Search/RegEx-for-the-free-m-command-Linux/m-p/176198#M50594 aferone 2014-08-08T14:07:10Z https://community.splunk.com/t5/Splunk-Search/RegEx-for-the-free-m-command-Linux/m-p/176199#M50595 <P>Hello</P> <P>Use this regex to extract both values at the same time:</P> <PRE><CODE>... | rex "\:\s+(?&lt;usedmemory&gt;\d+)\s+(?&lt;freememory&gt;\d+)" | ... </CODE></PRE> <P>Regards</P> Fri, 08 Aug 2014 14:45:40 GMT https://community.splunk.com/t5/Splunk-Search/RegEx-for-the-free-m-command-Linux/m-p/176199#M50595 gfuente 2014-08-08T14:45:40Z https://community.splunk.com/t5/Splunk-Search/RegEx-for-the-free-m-command-Linux/m-p/176200#M50596 <P>Perfect!! Thank you!</P> Fri, 08 Aug 2014 18:09:05 GMT https://community.splunk.com/t5/Splunk-Search/RegEx-for-the-free-m-command-Linux/m-p/176200#M50596 aferone 2014-08-08T18:09:05Z