Splunk Search

What is a regular expression that ignores whitespace and text, and captures only numbers of varying lengths?

Lucas_Henry_
New Member

I'm trying to write a regular expression that will find only the numbers in the string of text below:

MemTotal: 16328352 kB

I don't want the alphabetical or whitespace characters. I just want (in this example) "16328352".

I can't find a specification on a regular expression that will ignore certain data types, however.

0 Karma

sundareshr
Legend

You already have 4 options, why not one more 🙂 Try this

MemTotal:\s*(?<mem>\d+)"
0 Karma

somesoni2
Revered Legend

Give this a shot

MemTotal\:\s+(?<MemoryTotal>[^\s]+)
0 Karma

inventsekar
Super Champion

edit - tried this and its working good.

sourcetype=rexmemtotal | rex field=_raw "(MemTotal:\s+(?P<rexmemtotal>\d+))" | table rexmemtotal _raw
0 Karma

inventsekar
Super Champion
0 Karma

skoelpin
SplunkTrust
SplunkTrust

Try this

... | rex (?P<MemTotal>(?<=MemTotal\:\s)\d+(?=\s\w{2}))

Lucas_Henry_
New Member

What would this look like if I were to plug it into the field extractor tool?

0 Karma

skoelpin
SplunkTrust
SplunkTrust

Like this

(?P<MemTotal>(?<=MemTotal\:\s)\d+(?=\s\w{2}))

0 Karma

Lucas_Henry_
New Member

Still nothing, unfortunately.

If it helps, the amount of whitespace and the number of integers will vary between records.

0 Karma

skoelpin
SplunkTrust
SplunkTrust

Ahh yeah the amount of whitespace mattered, but this should work

(?P<MemTotal>MemTotal\:\s+(?<MemoryTotal>[^\s]+))

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try "MemTotal: (?<memTotal>\d+)".

---
If this reply helps you, an upvote would be appreciated.
0 Karma

Lucas_Henry_
New Member

No dice. It didn't extract anything.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Did you use it in a rex command?

---
If this reply helps you, an upvote would be appreciated.
0 Karma

Lucas_Henry_
New Member

No. I'm trying to use the field extractor because the info is for a non-dev unit

0 Karma