Splunk Search

What is a regular expression that ignores whitespace and text, and captures only numbers of varying lengths?

Lucas_Henry_
New Member

I'm trying to write a regular expression that will find only the numbers in the string of text below:

MemTotal: 16328352 kB

I don't want the alphabetical or whitespace characters. I just want (in this example) "16328352".

I can't find a specification on a regular expression that will ignore certain data types, however.

0 Karma

sundareshr
Legend

You already have 4 options, why not one more 🙂 Try this

MemTotal:\s*(?<mem>\d+)"
0 Karma

somesoni2
Revered Legend

Give this a shot

MemTotal\:\s+(?<MemoryTotal>[^\s]+)
0 Karma

inventsekar
SplunkTrust
SplunkTrust

edit - tried this and its working good.

sourcetype=rexmemtotal | rex field=_raw "(MemTotal:\s+(?P<rexmemtotal>\d+))" | table rexmemtotal _raw
0 Karma

skoelpin
SplunkTrust
SplunkTrust

Try this

... | rex (?P<MemTotal>(?<=MemTotal\:\s)\d+(?=\s\w{2}))

Lucas_Henry_
New Member

What would this look like if I were to plug it into the field extractor tool?

0 Karma

skoelpin
SplunkTrust
SplunkTrust

Like this

(?P<MemTotal>(?<=MemTotal\:\s)\d+(?=\s\w{2}))

0 Karma

Lucas_Henry_
New Member

Still nothing, unfortunately.

If it helps, the amount of whitespace and the number of integers will vary between records.

0 Karma

skoelpin
SplunkTrust
SplunkTrust

Ahh yeah the amount of whitespace mattered, but this should work

(?P<MemTotal>MemTotal\:\s+(?<MemoryTotal>[^\s]+))

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try "MemTotal: (?<memTotal>\d+)".

---
If this reply helps you, Karma would be appreciated.
0 Karma

Lucas_Henry_
New Member

No dice. It didn't extract anything.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Did you use it in a rex command?

---
If this reply helps you, Karma would be appreciated.
0 Karma

Lucas_Henry_
New Member

No. I'm trying to use the field extractor because the info is for a non-dev unit

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...