topic Re: Regex generation in Splunk Search

Regex generation

Deepz2612 — Fri, 25 Oct 2019 11:56:18 GMT

I have the below set of events where I wanted to write regex to capture only the last word

Kindly help

rmmiller — Fri, 25 Oct 2019 16:06:26 GMT

Assuming you just want the last word in each event, this should work fine:

.+\b(\w+)$

If you want a more restrictive match, looking for only "begin" or "end", then this should work:

.+\b(begin|end)$

Hope that helps!
rmmiller

Edit: Used https://regexr.com/ to test/generate regex.

gcusello — Fri, 25 Oct 2019 16:40:05 GMT

Hi Deepz2612,
I don't see the set of events.
Anyway, to extract the last word od an event and put it in a field, you could use a regex like this:

| rex "\s+(?<my_field>\w+)$"

Ciao.
Giuseppe

woodcock — Fri, 25 Oct 2019 20:22:56 GMT

Like this:

... | rex "(?<LastWord>\w+)$"