Splunk Search

What is a regular expression that ignores whitespace and text, and captures only numbers of varying lengths?

Lucas_Henry_
New Member

I'm trying to write a regular expression that will find only the numbers in the string of text below:

MemTotal: 16328352 kB

I don't want the alphabetical or whitespace characters. I just want (in this example) "16328352".

I can't find a specification on a regular expression that will ignore certain data types, however.

0 Karma

sundareshr
Legend

You already have 4 options, why not one more 🙂 Try this

MemTotal:\s*(?<mem>\d+)"
0 Karma

somesoni2
Revered Legend

Give this a shot

MemTotal\:\s+(?<MemoryTotal>[^\s]+)
0 Karma

inventsekar
SplunkTrust
SplunkTrust

edit - tried this and its working good.

sourcetype=rexmemtotal | rex field=_raw "(MemTotal:\s+(?P<rexmemtotal>\d+))" | table rexmemtotal _raw
thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma

inventsekar
SplunkTrust
SplunkTrust

splunk document link for rex learning
http://docs.splunk.com/Documentation/Splunk/6.4.2/Knowledge/AboutSplunkregularexpressions
http://docs.splunk.com/Documentation/Splunk/6.4.2/SearchReference/Rex

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma

skoelpin
SplunkTrust
SplunkTrust

Try this

... | rex (?P<MemTotal>(?<=MemTotal\:\s)\d+(?=\s\w{2}))

Lucas_Henry_
New Member

What would this look like if I were to plug it into the field extractor tool?

0 Karma

skoelpin
SplunkTrust
SplunkTrust

Like this

(?P<MemTotal>(?<=MemTotal\:\s)\d+(?=\s\w{2}))

0 Karma

Lucas_Henry_
New Member

Still nothing, unfortunately.

If it helps, the amount of whitespace and the number of integers will vary between records.

0 Karma

skoelpin
SplunkTrust
SplunkTrust

Ahh yeah the amount of whitespace mattered, but this should work

(?P<MemTotal>MemTotal\:\s+(?<MemoryTotal>[^\s]+))

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try "MemTotal: (?<memTotal>\d+)".

---
If this reply helps you, Karma would be appreciated.
0 Karma

Lucas_Henry_
New Member

No dice. It didn't extract anything.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Did you use it in a rex command?

---
If this reply helps you, Karma would be appreciated.
0 Karma

Lucas_Henry_
New Member

No. I'm trying to use the field extractor because the info is for a non-dev unit

0 Karma
Get Updates on the Splunk Community!

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...