It looks like not all the val are getting populated for each events (could be null). Try this
sourcetype=splunklog metric="memory"|rex field=_raw "(?i)memory-used\s+(?P<val>\d+)" |rex field=_raw "(?i)memory-buffered\s+(?P<val1>\d+)" |rex "(?i)memory-cached\s+(?P<val2>\d+)"|rex "(?i)memory-slab_unrecl\s+(?P<val3>\d+)"|rex "(?i)memory-slab_recl\s+(?P<val4>\d+)" | fillnull value=0 val* | eval sum=(val+val1+val2+val3+val4) | table sum val1 val2 val3
OR
sourcetype=splunklog metric="memory"|rex field=_raw "(?i)memory-used\s+(?P<val>\d+)" |rex field=_raw "(?i)memory-buffered\s+(?P<val1>\d+)" |rex "(?i)memory-cached\s+(?P<val2>\d+)"|rex "(?i)memory-slab_unrecl\s+(?P<val3>\d+)"|rex "(?i)memory-slab_recl\s+(?P<val4>\d+)" | eval sum=(coalesce(val,0)+coalesce(val1,0)+coalesce(val2,0)+coalesce(val3,0)+coalesce(val4,0)) | table sum val1 val2 val3
... View more