Extract sub string from address

[sndpgiri]

I have the following address, and I want to extract the substring.

Address: 121, riverstreet, sydney, Australia.

I want to extract 'sydney'.

Help would be highly appreciated.

[ITWhisperer]

Assuming you already have the Address in a field called Address

| eval city=mvindex(split(Address,","),3)

or

| rex field=Address "([^,]+,){2}(?<city>[^,]+)"

Otherwise, use

| rex "Address:\s([^,]+,){2}(?<city>[^,]+)"