https://community.splunk.com/t5/Splunk-Search/How-to-Extract-a-Part-of-the-field-in-splunk/m-p/514046#M144289 <P>| eval result=mvindex(split(URL,"/"),-1)</P> Fri, 14 Aug 2020 08:32:55 GMT to4kawa 2020-08-14T08:32:55Z https://community.splunk.com/t5/Splunk-Search/How-to-Extract-a-Part-of-the-field-in-splunk/m-p/514040#M144286 <P>Hi Everyone,</P><P>It would be great if someone help me on this.</P><P>I am having one field URL in my raw data.</P><P>URL =&nbsp;<A href="https://jfghdw.ind.com:1001/api/flow/groups/186yugh-w12-567c-b89-pghj67y" target="_blank" rel="noopener">https://jfghdw.ind.com:1001/xyz/flow/group/186yugh-w12-567c-b89-pghj67y</A></P><P>Now I want to extract only the last portion(that will be different for each URL so Cant take hard coded value) of the field URL&nbsp;</P><P>How to extract the 6th portion of the field that is "<A href="https://jfghdw.ind.com:1001/api/flow/groups/186yugh-w12-567c-b89-pghj67y" target="_blank" rel="noopener">186yugh-w12-567c-b89-pghj67y"</A>&nbsp;(It will be different for each URL)</P><P>using regular expression.</P><P>&nbsp;</P> Fri, 14 Aug 2020 07:16:49 GMT https://community.splunk.com/t5/Splunk-Search/How-to-Extract-a-Part-of-the-field-in-splunk/m-p/514040#M144286 chavi 2020-08-14T07:16:49Z https://community.splunk.com/t5/Splunk-Search/How-to-Extract-a-Part-of-the-field-in-splunk/m-p/514046#M144289 <P>| eval result=mvindex(split(URL,"/"),-1)</P> Fri, 14 Aug 2020 08:32:55 GMT https://community.splunk.com/t5/Splunk-Search/How-to-Extract-a-Part-of-the-field-in-splunk/m-p/514046#M144289 to4kawa 2020-08-14T08:32:55Z https://community.splunk.com/t5/Splunk-Search/How-to-Extract-a-Part-of-the-field-in-splunk/m-p/514069#M144292 <P>Hi Chavi,&nbsp;</P><P>Is the URL always going to be the same?</P><P>If that is the case you could use the following: regular expression:</P><DIV class="mceNonEditable lia-copypaste-placeholder">&nbsp;</DIV><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="snippet.PNG" style="width: 999px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/10251i9E69FFBEB110E38D/image-size/large?v=v2&amp;px=999" role="button" title="snippet.PNG" alt="snippet.PNG" /></span></P><P>If the URL is dynamic in each event then its probably best to use a <A href="https://docs.splunk.com/Documentation/Splunk/8.0.5/SearchReference/MultivalueEvalFunctions" target="_blank" rel="noopener">multi value eval function</A> like mvindex:</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Capture.PNG" style="width: 999px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/10252iF1EEFF91A2603538/image-size/large?v=v2&amp;px=999" role="button" title="Capture.PNG" alt="Capture.PNG" /></span></P><P>&nbsp;</P><P>If you have any more question do not hesitate to respond.</P><P>Best regards,&nbsp;</P><P>bquirin</P> Fri, 14 Aug 2020 10:53:30 GMT https://community.splunk.com/t5/Splunk-Search/How-to-Extract-a-Part-of-the-field-in-splunk/m-p/514069#M144292 bquirin 2020-08-14T10:53:30Z