Not adding up

[bbhandari012]

sourcetype=splunklog metric="memory"|rex field=_raw "(?i)memory-used\s+(?P\d+)" |rex field=_raw "(?i)memory-buffered\s+(?P\d+)" |rex "(?i)memory-cached\s+(?P\d+)"|rex "(?i)memory-slab_unrecl\s+(?P\d+)"|rex "(?i)memory-slab_recl\s+(?P\d+)"| eval sum=(val+val1+val2+val3+val4) | table sum val1 val2 val3

its not adding the value, but shows the individual value fine. Can one one please help me ??

[somesoni2]

It looks like not all the val are getting populated for each events (could be null). Try this

sourcetype=splunklog metric="memory"|rex field=_raw "(?i)memory-used\s+(?P<val>\d+)" |rex field=_raw "(?i)memory-buffered\s+(?P<val1>\d+)" |rex "(?i)memory-cached\s+(?P<val2>\d+)"|rex "(?i)memory-slab_unrecl\s+(?P<val3>\d+)"|rex "(?i)memory-slab_recl\s+(?P<val4>\d+)" | fillnull value=0 val* | eval sum=(val+val1+val2+val3+val4) | table sum val1 val2 val3

OR

sourcetype=splunklog metric="memory"|rex field=_raw "(?i)memory-used\s+(?P<val>\d+)" |rex field=_raw "(?i)memory-buffered\s+(?P<val1>\d+)" |rex "(?i)memory-cached\s+(?P<val2>\d+)"|rex "(?i)memory-slab_unrecl\s+(?P<val3>\d+)"|rex "(?i)memory-slab_recl\s+(?P<val4>\d+)" | eval sum=(coalesce(val,0)+coalesce(val1,0)+coalesce(val2,0)+coalesce(val3,0)+coalesce(val4,0)) | table sum val1 val2 val3