What is a regular expression that ignores whitespace and text, and captures only numbers of varying lengths?

[Lucas_Henry_]

I'm trying to write a regular expression that will find only the numbers in the string of text below:

MemTotal: 16328352 kB

I don't want the alphabetical or whitespace characters. I just want (in this example) "16328352".

I can't find a specification on a regular expression that will ignore certain data types, however.

[sundareshr]

You already have 4 options, why not one more 🙂 Try this

MemTotal:\s*(?<mem>\d+)"

[somesoni2]

Give this a shot

MemTotal\:\s+(?<MemoryTotal>[^\s]+)

[inventsekar]

edit - tried this and its working good.

sourcetype=rexmemtotal | rex field=_raw "(MemTotal:\s+(?P<rexmemtotal>\d+))" | table rexmemtotal _raw

[inventsekar]

splunk document link for rex learning
http://docs.splunk.com/Documentation/Splunk/6.4.2/Knowledge/AboutSplunkregularexpressions
http://docs.splunk.com/Documentation/Splunk/6.4.2/SearchReference/Rex

[skoelpin]

Try this

... | rex (?P<MemTotal>(?<=MemTotal\:\s)\d+(?=\s\w{2}))

[Lucas_Henry_]

What would this look like if I were to plug it into the field extractor tool?

[skoelpin]

Like this

(?P<MemTotal>(?<=MemTotal\:\s)\d+(?=\s\w{2}))

[Lucas_Henry_]

Still nothing, unfortunately.

If it helps, the amount of whitespace and the number of integers will vary between records.

[skoelpin]

Ahh yeah the amount of whitespace mattered, but this should work

(?P<MemTotal>MemTotal\:\s+(?<MemoryTotal>[^\s]+))

[richgalloway]

Try "MemTotal: (?<memTotal>\d+)".

[Lucas_Henry_]

No dice. It didn't extract anything.

[richgalloway]

Did you use it in a rex command?

[Lucas_Henry_]

No. I'm trying to use the field extractor because the info is for a non-dev unit