topic What is the rex command to extract the last value from a source field? in Splunk Search

What is the rex command to extract the last value from a source field?

simona2121 — Fri, 16 Sep 2016 12:18:28 GMT

Hi .. I need to extract back123 from the source field. pls provide the entire rex command needed to fetch back123 to a new field.
eg:

source = /opensource/final/back123

Re: What is the rex command to extract the last value from a source field?

inventsekar — Fri, 16 Sep 2016 12:25:51 GMT

if that source is part of your event, then field=_raw is good.

yoursearch | rex field=_raw "final\/(?<rexField>.*)" | table rexField

if that source is splunk extracted source field, then field=source is good.

yoursearch | rex field=source "final\/(?<rexField>.*)" | table rexField

Re: What is the rex command to extract the last value from a source field?

gcusello — Fri, 16 Sep 2016 12:33:02 GMT

Try this:

 yoursearch | rex field=source ".*\/(?[^ ]+)" | table myfield

Bye.
Giuseppe

Re: What is the rex command to extract the last value from a source field?

woodcock — Fri, 16 Sep 2016 14:03:38 GMT

Like this:

... | rex field=source ".*?(?<fn>[^\/]*)$"

Re: What is the rex command to extract the last value from a source field?

sundareshr — Fri, 16 Sep 2016 14:11:04 GMT

Let's make it an even 4

... | rex field=source "\/(?<folder>[^\/]*)$"

Re: What is the rex command to extract the last value from a source field?

lakromani — Thu, 29 Sep 2016 10:23:17 GMT

This should do:

... | rex field=source ".*\/(?<new>\S+)"

https://regex101.com/r/QEsDmB/1

Re: What is the rex command to extract the last value from a source field?

lukejadamec — Thu, 29 Sep 2016 13:47:07 GMT

Joining the answer party...

Try this

source = "*opensource*" | dedup source | rex field=source ".*\/(?<new>.*)" | table source, new

Re: What is the rex command to extract the last value from a source field?

aaraneta_splunk — Fri, 30 Sep 2016 00:49:52 GMT

Hi @simona2121 - Looks like you have several answers to try out 🙂 If one of them has worked, please click "Accept" below the best answer to resolve this post. Thank you!