https://community.splunk.com/t5/Splunk-Search/Regex-pattern/m-p/249285#M74434 <P>A simple approach might be something like:</P> <PRE><CODE>| rex "forwarder\.memory\.memory-free\s+(?&lt;memory-free&gt;\d+)\s+" </CODE></PRE> <P>But surely you tried this or something very close to it? </P> Wed, 16 Mar 2016 06:54:24 GMT dwaddle 2016-03-16T06:54:24Z https://community.splunk.com/t5/Splunk-Search/Regex-pattern/m-p/249284#M74433 <P>How do i use the regex pattern to get only 13348864 for memory-free ?</P> <P>forwarder.memory.memory-cached 367001600 1458101573<BR /> forwarder.memory.memory-free 13348864 1458101573<BR /> forwarder.memory.memory-slab_recl 29585408 1458101573<BR /> forwarder.memory.memory-used 66830336 1458101573</P> Wed, 16 Mar 2016 04:17:25 GMT https://community.splunk.com/t5/Splunk-Search/Regex-pattern/m-p/249284#M74433 bbhandari012 2016-03-16T04:17:25Z https://community.splunk.com/t5/Splunk-Search/Regex-pattern/m-p/249285#M74434 <P>A simple approach might be something like:</P> <PRE><CODE>| rex "forwarder\.memory\.memory-free\s+(?&lt;memory-free&gt;\d+)\s+" </CODE></PRE> <P>But surely you tried this or something very close to it? </P> Wed, 16 Mar 2016 06:54:24 GMT https://community.splunk.com/t5/Splunk-Search/Regex-pattern/m-p/249285#M74434 dwaddle 2016-03-16T06:54:24Z https://community.splunk.com/t5/Splunk-Search/Regex-pattern/m-p/249286#M74435 <P>Hi<BR /> Try this search code</P> <PRE><CODE> ..............| rex field=_raw "forwarder\.memory\.memory-free\s+(?&lt;memory_free&gt;[\d+]+)\s+" </CODE></PRE> Wed, 16 Mar 2016 09:17:11 GMT https://community.splunk.com/t5/Splunk-Search/Regex-pattern/m-p/249286#M74435 chimell 2016-03-16T09:17:11Z