Extracting the latest numeric value from the latest event to create a Gauge component in dashboard

[akotwale]

Hi Users, 

I have to create a gauge component to show the available memory in the system. As we know the gauge component take only single numeric value. So I need to extract the single numeric value from the latest event. My real time search event format is as follows - 

INFO  c.h.i.d.HealthMonitor - [100.64.29.192]:5701 [gfms] [3.12.9] processors=1, physical.memory.total=4.0G, physical.memory.free=3.4M, swap.space.total=0, swap.space.free=0, heap.memory.used=1.8G, heap.memory.free=1.3G, heap.memory.total=3.1G, heap.memory.max=4.0G, heap.memory.used/total=58.78%, heap.memory.used/max=45.22%, minor.gc.count=0, minor.gc.time=0ms, major.gc.count=0, major.gc.time=0ms, load.process=0.00%, load.system=72.25%, load.systemAverage=6.00,

In order to update the Gauge component, I need to extract the  value field of "physical.memory.free" property from the recent search event. Could you guys please let me know the Splunk query for it? 

[marysan · Accepted solution]

| rex field=_raw "physical.memory.free="(?<physical_memory_free>.*)"M"

[akotwale]

Thanks a lot @marysan. It solved my problem.