How to rex extract two last word?

indeed_2000 — Wed, 25 May 2022 18:23:32 GMT

Hi how can I extract only last 2 word that exist in className

I have log like this:

2022-05-24 16:29:51,918 INFO [APP] [ActionName] className[xx.xx.xxx.xxxx.xxx.session.controller.SearchClusterFinancialTcpMBean.search] status[done]

2022-05-24 16:29:51,918 INFO [APP] [ActionName] className[xx.xx.xxx.xxxx.xxx.session.controller.SearchClusterFinancialTcpMBean.search.attribute] status[done]

excpected output:

SearchClusterFinancialTcpMBean.search

search.attribute

Any idea?

Thanks,

Re: rex extract two last word

richgalloway — Wed, 25 May 2022 13:05:27 GMT

This regular expression should do it.

className\[.*?(?<lastTwo>[^\.]+\.[^\.]+?)]

Re: rex extract two last word

ITWhisperer — Wed, 25 May 2022 13:05:50 GMT

| rex "className.*\.(?<class>\w+\.\w+)\]"

topic How to rex extract two last word? in Splunk Search

How to rex extract two last word?

Re: rex extract two last word

Re: rex extract two last word