Splunk Search

Help with Regex extracting fields

saikumarsplunkt
New Member

Can someone please help with extracting the bold highlighted field from below

/07981368-d226-4cf6-8d88-9853c843bcb9/6311875594

Tags (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

At the risk of being too simple given the limited data set, try ... | rex "\/(?<field>[^\/]+)" | ....

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Enhance Your Splunk App Development: New Tools & Support

UCC FrameworkAdd-on Builder has been around for quite some time. It helps build Splunk apps faster, but it ...

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...