topic How do I extract the latest occurrence of a field from multiple lines? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-do-I-extract-the-latest-occurrence-of-a-field-from-multiple/m-p/405722#M117285 <P>Want to capture the latest occurrence of "working_condition_check - status -" which is "Stopped". </P> <P>Please help me in getting the regex.</P> <P>Below is the log message.</P> <P>10/01/2018 15:01:04 Server_Name<BR /> working_condition_check - status - Started<BR /> working_condition_check - status - Running<BR /> working_condition_check - status - Stopped</P> Tue, 29 Sep 2020 21:29:07 GMT nkchaitanya 2020-09-29T21:29:07Z How do I extract the latest occurrence of a field from multiple lines? https://community.splunk.com/t5/Splunk-Search/How-do-I-extract-the-latest-occurrence-of-a-field-from-multiple/m-p/405722#M117285 <P>Want to capture the latest occurrence of "working_condition_check - status -" which is "Stopped". </P> <P>Please help me in getting the regex.</P> <P>Below is the log message.</P> <P>10/01/2018 15:01:04 Server_Name<BR /> working_condition_check - status - Started<BR /> working_condition_check - status - Running<BR /> working_condition_check - status - Stopped</P> Tue, 29 Sep 2020 21:29:07 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-extract-the-latest-occurrence-of-a-field-from-multiple/m-p/405722#M117285 nkchaitanya 2020-09-29T21:29:07Z Re: How do I extract the latest occurrence of a field from multiple lines? https://community.splunk.com/t5/Splunk-Search/How-do-I-extract-the-latest-occurrence-of-a-field-from-multiple/m-p/405723#M117286 <P>Hi @nkchaitanya,<BR /> Try this:</P> <PRE><CODE>...|rex ".*status - (?&lt;status&gt;\w+)" </CODE></PRE> Wed, 03 Oct 2018 10:35:06 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-extract-the-latest-occurrence-of-a-field-from-multiple/m-p/405723#M117286 493669 2018-10-03T10:35:06Z Re: How do I extract the latest occurrence of a field from multiple lines? https://community.splunk.com/t5/Splunk-Search/How-do-I-extract-the-latest-occurrence-of-a-field-from-multiple/m-p/405724#M117287 <P>hi @nkchaitanya </P> <P>As @493669 answer follow that end of your query add this </P> <PRE><CODE>| makeresults |eval hari="working_condition_check - status - Stopped" |rex field=hari ".*status - (?&lt;status&gt;\w+)" |where status="Stopped" </CODE></PRE> Wed, 03 Oct 2018 10:51:56 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-extract-the-latest-occurrence-of-a-field-from-multiple/m-p/405724#M117287 harishalipaka 2018-10-03T10:51:56Z