Regex pattern

[bbhandari012]

How do i use the regex pattern to get only 13348864 for memory-free ?

forwarder.memory.memory-cached 367001600 1458101573
forwarder.memory.memory-free 13348864 1458101573
forwarder.memory.memory-slab_recl 29585408 1458101573
forwarder.memory.memory-used 66830336 1458101573

[chimell]

Hi
Try this search code

    ..............| rex  field=_raw "forwarder\.memory\.memory-free\s+(?<memory_free>[\d+]+)\s+"

[dwaddle]

A simple approach might be something like:

| rex "forwarder\.memory\.memory-free\s+(?<memory-free>\d+)\s+"

But surely you tried this or something very close to it?