topic Re: What is a regular expression that ignores whitespace and text, and captures only numbers of varying lengths? in Splunk Search

What is a regular expression that ignores whitespace and text, and captures only numbers of varying lengths?

Lucas_Henry_ — Fri, 05 Aug 2016 14:56:07 GMT

I'm trying to write a regular expression that will find only the numbers in the string of text below:

MemTotal: 16328352 kB

I don't want the alphabetical or whitespace characters. I just want (in this example) "16328352".

I can't find a specification on a regular expression that will ignore certain data types, however.

Re: What is a regular expression that ignores whitespace and text, and captures only numbers of varying lengths?

richgalloway — Fri, 05 Aug 2016 15:00:32 GMT

Try "MemTotal: (?<memTotal>\d+)".

Re: What is a regular expression that ignores whitespace and text, and captures only numbers of varying lengths?

skoelpin — Fri, 05 Aug 2016 15:00:43 GMT

Try this

... | rex (?P<MemTotal>(?<=MemTotal\:\s)\d+(?=\s\w{2}))

Re: What is a regular expression that ignores whitespace and text, and captures only numbers of varying lengths?

Lucas_Henry_ — Fri, 05 Aug 2016 15:08:36 GMT

What would this look like if I were to plug it into the field extractor tool?

Re: What is a regular expression that ignores whitespace and text, and captures only numbers of varying lengths?

Lucas_Henry_ — Fri, 05 Aug 2016 15:09:29 GMT

No dice. It didn't extract anything.

Re: What is a regular expression that ignores whitespace and text, and captures only numbers of varying lengths?

skoelpin — Fri, 05 Aug 2016 15:10:23 GMT

Like this

(?P<MemTotal>(?<=MemTotal\:\s)\d+(?=\s\w{2}))

Re: What is a regular expression that ignores whitespace and text, and captures only numbers of varying lengths?

Lucas_Henry_ — Fri, 05 Aug 2016 15:13:44 GMT

Still nothing, unfortunately.

If it helps, the amount of whitespace and the number of integers will vary between records.

Re: What is a regular expression that ignores whitespace and text, and captures only numbers of varying lengths?

richgalloway — Fri, 05 Aug 2016 15:13:53 GMT

Did you use it in a rex command?

Re: What is a regular expression that ignores whitespace and text, and captures only numbers of varying lengths?

Lucas_Henry_ — Fri, 05 Aug 2016 15:14:35 GMT

No. I'm trying to use the field extractor because the info is for a non-dev unit

Re: What is a regular expression that ignores whitespace and text, and captures only numbers of varying lengths?

inventsekar — Fri, 05 Aug 2016 15:20:34 GMT

edit - tried this and its working good.

sourcetype=rexmemtotal | rex field=_raw "(MemTotal:\s+(?P<rexmemtotal>\d+))" | table rexmemtotal _raw

Re: What is a regular expression that ignores whitespace and text, and captures only numbers of varying lengths?

somesoni2 — Fri, 05 Aug 2016 15:24:18 GMT

Give this a shot

MemTotal\:\s+(?<MemoryTotal>[^\s]+)

Re: What is a regular expression that ignores whitespace and text, and captures only numbers of varying lengths?

skoelpin — Fri, 05 Aug 2016 15:31:25 GMT

Ahh yeah the amount of whitespace mattered, but this should work

(?P<MemTotal>MemTotal\:\s+(?<MemoryTotal>[^\s]+))

Re: What is a regular expression that ignores whitespace and text, and captures only numbers of varying lengths?

inventsekar — Fri, 05 Aug 2016 15:41:11 GMT

splunk document link for rex learning
http://docs.splunk.com/Documentation/Splunk/6.4.2/Knowledge/AboutSplunkregularexpressions
http://docs.splunk.com/Documentation/Splunk/6.4.2/SearchReference/Rex

Re: What is a regular expression that ignores whitespace and text, and captures only numbers of varying lengths?

sundareshr — Fri, 05 Aug 2016 17:41:57 GMT

You already have 4 options, why not one more 🙂 Try this

MemTotal:\s*(?<mem>\d+)"