topic Re: Show last part of a result after a / in Splunk Search https://community.splunk.com/t5/Splunk-Search/Show-last-part-of-a-result-after-a/m-p/409144#M170862 <P>Use the <CODE>rex</CODE> command. Here is one way. others may find a better one.</P> <PRE><CODE>... | rex "(?:\/[^\/]+)+\/(?&lt;field&gt;.*?$)" | ... </CODE></PRE> Thu, 06 Jun 2019 11:44:00 GMT richgalloway 2019-06-06T11:44:00Z Show last part of a result after a / https://community.splunk.com/t5/Splunk-Search/Show-last-part-of-a-result-after-a/m-p/409143#M170861 <P>A result of a search for a field resourceId is</P> <P>/SUBSCRIPTIONS/9B8874C9-5DC3-46CE-908A-D00EE594A4EC/PROVIDERS/MICROSOFT.SECURITY/LOCATIONS/WESTEUROPE/ALERTS/2518432613670999141_1736EDA9-63D3-4CD2-8E54-79828127B011</P> <P>I only want to see the result after the last /<BR /> So: 2518432613670999141_1736EDA9-63D3-4CD2-8E54-79828127B011</P> <P>What's the way to do this?</P> Thu, 06 Jun 2019 09:36:10 GMT https://community.splunk.com/t5/Splunk-Search/Show-last-part-of-a-result-after-a/m-p/409143#M170861 kemnean2001 2019-06-06T09:36:10Z Re: Show last part of a result after a / https://community.splunk.com/t5/Splunk-Search/Show-last-part-of-a-result-after-a/m-p/409144#M170862 <P>Use the <CODE>rex</CODE> command. Here is one way. others may find a better one.</P> <PRE><CODE>... | rex "(?:\/[^\/]+)+\/(?&lt;field&gt;.*?$)" | ... </CODE></PRE> Thu, 06 Jun 2019 11:44:00 GMT https://community.splunk.com/t5/Splunk-Search/Show-last-part-of-a-result-after-a/m-p/409144#M170862 richgalloway 2019-06-06T11:44:00Z Re: Show last part of a result after a / https://community.splunk.com/t5/Splunk-Search/Show-last-part-of-a-result-after-a/m-p/409145#M170863 <P>Tx...this helps indeed<BR /> Martin</P> Thu, 06 Jun 2019 12:11:21 GMT https://community.splunk.com/t5/Splunk-Search/Show-last-part-of-a-result-after-a/m-p/409145#M170863 kemnean2001 2019-06-06T12:11:21Z Re: Show last part of a result after a / https://community.splunk.com/t5/Splunk-Search/Show-last-part-of-a-result-after-a/m-p/409146#M170864 <P>If your problem is resolved, please accept the answer to help future readers.</P> Thu, 06 Jun 2019 22:41:49 GMT https://community.splunk.com/t5/Splunk-Search/Show-last-part-of-a-result-after-a/m-p/409146#M170864 richgalloway 2019-06-06T22:41:49Z