topic Re: Regex to extract last words in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-extract-last-words/m-p/646228#M223696 <LI-CODE lang="markup">| rex "(?&lt;lastword&gt;[\w-]+)\W*?$"</LI-CODE> Thu, 08 Jun 2023 04:16:26 GMT ITWhisperer 2023-06-08T04:16:26Z How to extract last words? https://community.splunk.com/t5/Splunk-Search/How-to-extract-last-words/m-p/646226#M223694 <P>Hi I have sample like this</P> <P>Source&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;<BR />Sample time from tx-templated&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;<BR />efghi examl from templated&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;<BR />Sample time from [templated]&nbsp; &nbsp; &nbsp; &nbsp;</P> <P>I want to extract the the values of last word as show below&nbsp;</P> <P><SPAN>Source&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Extract Value</SPAN><BR /><SPAN>Sample time from <STRONG>tx-templated</STRONG>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;tx-templated</SPAN><BR /><SPAN>efghi examl from <STRONG>templated&nbsp; &nbsp;</STRONG> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; templated</SPAN><BR /><SPAN>Sample time from [<STRONG>templated</STRONG>]&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;templated</SPAN> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;</P> <P>&nbsp;</P> <P>how to do via regex?</P> <P>&nbsp;</P> <P>Thanks in advance for help</P> Thu, 08 Jun 2023 12:44:28 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-last-words/m-p/646226#M223694 akshayinnamuri 2023-06-08T12:44:28Z Re: Regex to extract last words https://community.splunk.com/t5/Splunk-Search/How-to-extract-last-words/m-p/646228#M223696 <LI-CODE lang="markup">| rex "(?&lt;lastword&gt;[\w-]+)\W*?$"</LI-CODE> Thu, 08 Jun 2023 04:16:26 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-last-words/m-p/646228#M223696 ITWhisperer 2023-06-08T04:16:26Z