All Apps and Add-ons

Retrieve last value in a comma-delimited field

ericksond
Engager

If my rex field has one or multiple fields delimited by commas, how can I get the last value if there is more than one? Or if there is only one value, then retrieve that one.

Search: sourcetype="xxxxxx" | rex field=_raw "True IP:(?.*)"

True IP:68.5.194.110, 204.2.160.228
True IP:81.21.89.165

0 Karma
1 Solution

ericksond
Engager

Thank you Kristian, you did give me the idea to resolve the issue correctly. It appears that what I needed was the first IP address and not the last.

I discovered erex and what a powerful tool! It generated the following rex that solved my problem:

rex "(?i) IP?:(?P<true_ip>\d+\.\d+\.\d+\.\d+)" 

View solution in original post

0 Karma

ericksond
Engager

Thank you Kristian, you did give me the idea to resolve the issue correctly. It appears that what I needed was the first IP address and not the last.

I discovered erex and what a powerful tool! It generated the following rex that solved my problem:

rex "(?i) IP?:(?P<true_ip>\d+\.\d+\.\d+\.\d+)" 
0 Karma

kristian_kolb
Ultra Champion

If you are not interested in the first of two TrueIP's, you could always do something like this for a log message that looks like:

message=blah user=admin true IP: 1.2.3.4, 2.3.4.5 error=fatal 

the field extraction would be something like:

rex ",?\s(?<true_ip>\d+\.\d+\.\d+\.\d+)\serror="

hope this helps, but please provide more info in order to get better help

/k

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...