topic Re: How can i fetch the second last word of a sentence with the splunk with the regex in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-fetch-the-second-last-word-of-a-sentence-with-the-Splunk/m-p/586303#M204245 <P>Can you please see the updated question</P> Wed, 23 Feb 2022 19:55:06 GMT riginoommen 2022-02-23T19:55:06Z How to fetch the second last word of a sentence with the Splunk regex? https://community.splunk.com/t5/Splunk-Search/How-to-fetch-the-second-last-word-of-a-sentence-with-the-Splunk/m-p/586299#M204243 <P>My query is:</P> <P>&nbsp;</P> <LI-CODE lang="markup">Mozilla/5.0 (X11; Linux x86_64; Catchpoint) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36</LI-CODE> <P>&nbsp;</P> <P>I want to extract the following word from the above sting with regex can you please help me.</P> <P>&nbsp;</P> <LI-CODE lang="markup">Chrome/87.0.4280.88</LI-CODE> <P>&nbsp;</P> Wed, 23 Feb 2022 20:18:07 GMT https://community.splunk.com/t5/Splunk-Search/How-to-fetch-the-second-last-word-of-a-sentence-with-the-Splunk/m-p/586299#M204243 riginoommen 2022-02-23T20:18:07Z Re: How can i fetch the last word of a sentence with the splunk with the regex https://community.splunk.com/t5/Splunk-Search/How-to-fetch-the-second-last-word-of-a-sentence-with-the-Splunk/m-p/586302#M204244 <P>Hi!</P><P>Try this Regex.</P><P>&nbsp;</P><LI-CODE lang="markup">\b(\S+)$</LI-CODE> Wed, 23 Feb 2022 19:52:28 GMT https://community.splunk.com/t5/Splunk-Search/How-to-fetch-the-second-last-word-of-a-sentence-with-the-Splunk/m-p/586302#M204244 Stefanie 2022-02-23T19:52:28Z Re: How can i fetch the second last word of a sentence with the splunk with the regex https://community.splunk.com/t5/Splunk-Search/How-to-fetch-the-second-last-word-of-a-sentence-with-the-Splunk/m-p/586303#M204245 <P>Can you please see the updated question</P> Wed, 23 Feb 2022 19:55:06 GMT https://community.splunk.com/t5/Splunk-Search/How-to-fetch-the-second-last-word-of-a-sentence-with-the-Splunk/m-p/586303#M204245 riginoommen 2022-02-23T19:55:06Z Re: How can i fetch the last word of a sentence with the splunk with the regex https://community.splunk.com/t5/Splunk-Search/How-to-fetch-the-second-last-word-of-a-sentence-with-the-Splunk/m-p/586305#M204247 <DIV class=""><DIV class=""><P>Can you please see the updated question with the answer and I am trying to accommodate with the res. it will be super awesome if you share the full url</P></DIV></DIV> Wed, 23 Feb 2022 19:57:57 GMT https://community.splunk.com/t5/Splunk-Search/How-to-fetch-the-second-last-word-of-a-sentence-with-the-Splunk/m-p/586305#M204247 riginoommen 2022-02-23T19:57:57Z Re: How can i fetch the last word of a sentence with the splunk with the regex https://community.splunk.com/t5/Splunk-Search/How-to-fetch-the-second-last-word-of-a-sentence-with-the-Splunk/m-p/586306#M204248 <P>How to use the regex with the rex tag</P><DIV class=""><DIV class=""><PRE>\b(\S+)$</PRE></DIV></DIV><DIV class=""><DIV class=""><DIV class=""><DIV>can you please help me</DIV></DIV><DIV class=""><DIV><DIV class=""><DIV class=""><DIV class="">&nbsp;</DIV></DIV></DIV></DIV></DIV></DIV></DIV> Wed, 23 Feb 2022 19:59:50 GMT https://community.splunk.com/t5/Splunk-Search/How-to-fetch-the-second-last-word-of-a-sentence-with-the-Splunk/m-p/586306#M204248 riginoommen 2022-02-23T19:59:50Z Re: How can i fetch the second last word of a sentence with the splunk with the regex https://community.splunk.com/t5/Splunk-Search/How-to-fetch-the-second-last-word-of-a-sentence-with-the-Splunk/m-p/586307#M204249 <P>Try like this (replace everything before "rex" command with your search)</P><LI-CODE lang="markup">|makeresults | eval _raw="Mozilla/5.0 (X11; Linux x86_64; Catchpoint) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36" | table _raw | rex "\s+(?&lt;SecondLastPart&gt;\S+)\s+\S+$"</LI-CODE><P>&nbsp;&nbsp;</P> Wed, 23 Feb 2022 20:15:21 GMT https://community.splunk.com/t5/Splunk-Search/How-to-fetch-the-second-last-word-of-a-sentence-with-the-Splunk/m-p/586307#M204249 somesoni2 2022-02-23T20:15:21Z Re: How can i fetch the second last word of a sentence with the splunk with the regex https://community.splunk.com/t5/Splunk-Search/How-to-fetch-the-second-last-word-of-a-sentence-with-the-Splunk/m-p/586309#M204251 <P>This fetched the data as expected but its not taking the filtered data from past output</P> Wed, 23 Feb 2022 20:31:09 GMT https://community.splunk.com/t5/Splunk-Search/How-to-fetch-the-second-last-word-of-a-sentence-with-the-Splunk/m-p/586309#M204251 riginoommen 2022-02-23T20:31:09Z Re: How can i fetch the second last word of a sentence with the splunk with the regex https://community.splunk.com/t5/Splunk-Search/How-to-fetch-the-second-last-word-of-a-sentence-with-the-Splunk/m-p/586315#M204253 <P>Sure</P><P>Try this one?</P><P>&nbsp;</P><LI-CODE lang="markup">\s\S+\/\S+\s(?!\()</LI-CODE> Wed, 23 Feb 2022 20:56:13 GMT https://community.splunk.com/t5/Splunk-Search/How-to-fetch-the-second-last-word-of-a-sentence-with-the-Splunk/m-p/586315#M204253 Stefanie 2022-02-23T20:56:13Z