Splunk Search

What is a regular expression that ignores whitespace and text, and captures only numbers of varying lengths?

Lucas_Henry_
New Member

I'm trying to write a regular expression that will find only the numbers in the string of text below:

MemTotal: 16328352 kB

I don't want the alphabetical or whitespace characters. I just want (in this example) "16328352".

I can't find a specification on a regular expression that will ignore certain data types, however.

0 Karma

sundareshr
Legend

You already have 4 options, why not one more 🙂 Try this

MemTotal:\s*(?<mem>\d+)"
0 Karma

somesoni2
Revered Legend

Give this a shot

MemTotal\:\s+(?<MemoryTotal>[^\s]+)
0 Karma

inventsekar
SplunkTrust
SplunkTrust

edit - tried this and its working good.

sourcetype=rexmemtotal | rex field=_raw "(MemTotal:\s+(?P<rexmemtotal>\d+))" | table rexmemtotal _raw
0 Karma

skoelpin
SplunkTrust
SplunkTrust

Try this

... | rex (?P<MemTotal>(?<=MemTotal\:\s)\d+(?=\s\w{2}))

Lucas_Henry_
New Member

What would this look like if I were to plug it into the field extractor tool?

0 Karma

skoelpin
SplunkTrust
SplunkTrust

Like this

(?P<MemTotal>(?<=MemTotal\:\s)\d+(?=\s\w{2}))

0 Karma

Lucas_Henry_
New Member

Still nothing, unfortunately.

If it helps, the amount of whitespace and the number of integers will vary between records.

0 Karma

skoelpin
SplunkTrust
SplunkTrust

Ahh yeah the amount of whitespace mattered, but this should work

(?P<MemTotal>MemTotal\:\s+(?<MemoryTotal>[^\s]+))

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try "MemTotal: (?<memTotal>\d+)".

---
If this reply helps you, Karma would be appreciated.
0 Karma

Lucas_Henry_
New Member

No dice. It didn't extract anything.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Did you use it in a rex command?

---
If this reply helps you, Karma would be appreciated.
0 Karma

Lucas_Henry_
New Member

No. I'm trying to use the field extractor because the info is for a non-dev unit

0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...