topic Need help creating a regex to grab anything after last comma in Splunk Search

Need help creating a regex to grab anything after last comma

mikehage — Wed, 17 Jun 2015 16:32:56 GMT

Hi,

Hope someone can help me with creating a regular expression for an extraction. I have a log file and the lines don't all have the same amount of information,but the information after the last comma always relates to the same field. I need to create a regular expression to associate anything after the last comma with an event type. When I try to do this without writing the regular expression it does not work for all lines.

Hope someone can help, let me know if you need more information.

here is a sample line:

"WBS","20150617131035-any-96095",701,0,"20150617171035Z","10.183.56.173",3,0,"","http://10.183.56.173:10021/mmsc/direct","","M-default","P-default",8799,3367,27,0,0,0,0,0,116,"",0,"",0,"","text/plain","iPhoneOS/8.3 (12F70)",200

So i would want to grab the "200" in this line but it's not always 200.

Thanks,
Mike

Re: Need help creating a regex to grab anything after last comma

richgalloway — Wed, 17 Jun 2015 16:47:35 GMT

A sample of your data would be useful, this will probably get you started.

.. | rex ",(?P<field>[^,]*?)$" | ...

Re: Need help creating a regex to grab anything after last comma

mikehage — Wed, 17 Jun 2015 17:11:44 GMT

here is a sample line:

"WBS","20150617131035-any-96095",701,0,"20150617171035Z","10.183.56.173",3,0,"","http://10.183.56.173:10021/mmsc/direct","","M-default","P-default",8799,3367,27,0,0,0,0,0,116,"",0,"",0,"","text/plain","iPhoneOS/8.3 (12F70)",200

So i would want to grab the "200" in this line but it's not always 200.

Re: Need help creating a regex to grab anything after last comma

richgalloway — Wed, 17 Jun 2015 17:19:56 GMT

The regex string in my answer should do it.

Re: Need help creating a regex to grab anything after last comma

aljohnson_splun — Wed, 17 Jun 2015 17:20:23 GMT

... | rex ",(?<status>\d+)$"

Re: Need help creating a regex to grab anything after last comma

tcottreau — Mon, 23 Apr 2018 23:31:03 GMT

If the last field is non-numeric, you will miss it. richgalloway above gave a nice, simple solution, i.e. match all non-comma characters up to the last comma in the line.

Re: Need help creating a regex to grab anything after last comma

woodcock — Tue, 24 Apr 2018 00:00:11 GMT

Like this:

... | rex ",(?<status>[^,]*)$"