topic Rex command help in Splunk Search

Rex command help

mpk_24 — Tue, 20 May 2025 00:36:51 GMT

Hey @Splunkers,

Looking for valuable insights for this use case.

I wanted to extract the numbers at the end of the log (highlighted in bold). Pls help.

Sample log:

74.133.120.000 - LASTHOP:142.136.168.1 - [19/May/2025:23:30:12 +0000] "GET /content/*/residential.existingCustomerProfileLoader.json HTTP/1.1" 200 143 "/cp/activate-apps?cmp=dotcom_sms_selectapps_111324" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Mobile Safari/537.36" 384622

Re: Rex command help

liangliang — Tue, 20 May 2025 01:05:36 GMT

you can try this (?P<number>\d+)$
the $ will match the end of this line

Re: Rex command help

mpk_24 — Tue, 20 May 2025 01:13:12 GMT

@liangliang thank you so much for your respond. This works. Appreciate very much.