All Apps and Add-ons

Hello experts, I would like to split the fourth part of value in splunk.

Ashwini_5
Explorer

Hello experts, I would like to split the  fourth part of below lines . Please provide your suggestion if I can use REGEX for it. 

Projects/IMGSD-102/Data/abc-NNN/00000000001
Projects/IMGSD-102/Data/abc-NNN/00000000001
Projects/IMGSD-102/Data/abc-NNNN/00000000001
Projects/IMGSD-102/Data/abc-NN/00000000001
Projects/IMGSD-102/Data/abc-N/00000000001

 

Now I need to get the answer as below.

abc-NNN

abc-NNN

abc-NNNN

abc-NN

abc-N

Kindly provide your suggestion for the same. 

 

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| rex "([^\/]+\/){3}(?<part>[^\/]+)\/"

View solution in original post

Ashwini_5
Explorer

Thanks a lot for your kind reply 🙂 @ITWhisperer  It helped me 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| rex "([^\/]+\/){3}(?<part>[^\/]+)\/"
Get Updates on the Splunk Community!

Index This | Why did the turkey cross the road?

November 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  &#x1f680; Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...