Splunk Search

RegEx for the free -m command - Linux

aferone
Builder

I have a script that runs the "free -m" command, and I am only pulling (grepping) the lines like the following:

-/+ buffers/cache:        219       1789
-/+ buffers/cache:       1469      10557

The first value is used memory, and the second value is free memory.

The RegEx for free memory works for all of the logs:

(?i)^[^:]*:\s+\d+\s+(?P<FreeMemory>.+)

However, for used memory, the following RegEx only works for the 2nd log line above, because of the amount of spaces between "cache:" and the value.

(?i)/cache:       (?P<UsedMemory>[^ ]+)

How do I get the RegEx to work, regardless of how many spaces are in between?

Thanks!

Tags (3)
1 Solution

gfuente
Motivator

Hello

Use this regex to extract both values at the same time:

... | rex "\:\s+(?<usedmemory>\d+)\s+(?<freememory>\d+)" | ...

Regards

View solution in original post

gfuente
Motivator

Hello

Use this regex to extract both values at the same time:

... | rex "\:\s+(?<usedmemory>\d+)\s+(?<freememory>\d+)" | ...

Regards

aferone
Builder

Perfect!! Thank you!

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...