If my rex field has one or multiple fields delimited by commas, how can I get the last value if there is more than one? Or if there is only one value, then retrieve that one.
Search: sourcetype="xxxxxx" | rex field=_raw "True IP:(?.*)"
True IP:188.8.131.52, 184.108.40.206
Thank you Kristian, you did give me the idea to resolve the issue correctly. It appears that what I needed was the first IP address and not the last.
I discovered erex and what a powerful tool! It generated the following rex that solved my problem:
rex "(?i) IP?:(?P<true_ip>\d+\.\d+\.\d+\.\d+)"
View solution in original post
If you are not interested in the first of two TrueIP's, you could always do something like this for a log message that looks like:
message=blah user=admin true IP: 220.127.116.11, 18.104.22.168 error=fatal
the field extraction would be something like:
hope this helps, but please provide more info in order to get better help