topic Help with regex on string with multiple number values in Splunk Search

Help with regex on string with multiple number values

morgantay96 — Thu, 05 May 2022 22:18:32 GMT

Hi all need help getting the trailing number from a field in a search.

Examples of the field

id = bdf73ad5-4499-4f70-b7e3-e2c81ae868c3-default-asset-423447

id = bdf73ad5-4499-4f70-b7e3-e2c81ae868c3-default-asset-6672

id = bdf73ad5-4499-4f70-b7e3-e2c81ae868c3-default-asset-4232323

I was using....

| eval stripped_asset_id=substr(id, -6)

however that only is consistent if the last numbers consist of 6 digits which it often may have more or less.

How can I take everything after the last dash "-"?

Re: Regex on string with multiple number values

jnorha — Thu, 05 May 2022 22:14:17 GMT

Try adding this pipe:

| rex field=id "(?<new_field_name>[^\-]*$)"

This will run a lookbehind from the last dash in the end of the string and create a new field with your new field name. In this case id is a field and the full string is that fields value

Re: Help with regex on string with multiple number values

gcusello — Fri, 06 May 2022 06:49:14 GMT

Hi @morgantay96,

you could also try this:

| rex field=id "^([^\-]*\-){7}(?<your_field>\d+)"

that you can test at https://regex101.com/r/dDfGBk/1

Ciao.

Giuseppe

Re: Regex on string with multiple number values

isoutamo — Fri, 06 May 2022 06:56:22 GMT

And if you want to optimise that regex then you can use this if all your id:s have above format.

| rex field=id "t-(?<new_field_name>\d+$)"

https://regex101.com/r/2qGsRf/1 (3 matches 33 steps)

vs. original

https://regex101.com/r/bhW62a/1 (6 matches 1 354 steps)

No mater if you have only couple of events, but when there are millions or more then this can be meaningful difference.

r. Ismo