Splunk Search

What is a regular expression that ignores whitespace and text, and captures only numbers of varying lengths?

Lucas_Henry_
New Member

I'm trying to write a regular expression that will find only the numbers in the string of text below:

MemTotal: 16328352 kB

I don't want the alphabetical or whitespace characters. I just want (in this example) "16328352".

I can't find a specification on a regular expression that will ignore certain data types, however.

0 Karma

sundareshr
Legend

You already have 4 options, why not one more 🙂 Try this

MemTotal:\s*(?<mem>\d+)"
0 Karma

somesoni2
Revered Legend

Give this a shot

MemTotal\:\s+(?<MemoryTotal>[^\s]+)
0 Karma

inventsekar
SplunkTrust
SplunkTrust

edit - tried this and its working good.

sourcetype=rexmemtotal | rex field=_raw "(MemTotal:\s+(?P<rexmemtotal>\d+))" | table rexmemtotal _raw
thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma

inventsekar
SplunkTrust
SplunkTrust

splunk document link for rex learning
http://docs.splunk.com/Documentation/Splunk/6.4.2/Knowledge/AboutSplunkregularexpressions
http://docs.splunk.com/Documentation/Splunk/6.4.2/SearchReference/Rex

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma

skoelpin
SplunkTrust
SplunkTrust

Try this

... | rex (?P<MemTotal>(?<=MemTotal\:\s)\d+(?=\s\w{2}))

Lucas_Henry_
New Member

What would this look like if I were to plug it into the field extractor tool?

0 Karma

skoelpin
SplunkTrust
SplunkTrust

Like this

(?P<MemTotal>(?<=MemTotal\:\s)\d+(?=\s\w{2}))

0 Karma

Lucas_Henry_
New Member

Still nothing, unfortunately.

If it helps, the amount of whitespace and the number of integers will vary between records.

0 Karma

skoelpin
SplunkTrust
SplunkTrust

Ahh yeah the amount of whitespace mattered, but this should work

(?P<MemTotal>MemTotal\:\s+(?<MemoryTotal>[^\s]+))

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try "MemTotal: (?<memTotal>\d+)".

---
If this reply helps you, Karma would be appreciated.
0 Karma

Lucas_Henry_
New Member

No dice. It didn't extract anything.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Did you use it in a rex command?

---
If this reply helps you, Karma would be appreciated.
0 Karma

Lucas_Henry_
New Member

No. I'm trying to use the field extractor because the info is for a non-dev unit

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...