Help with regex on string with multiple number values

[morgantay96]

Hi all need help getting the trailing number from a field in a search.

Examples of the field

id = bdf73ad5-4499-4f70-b7e3-e2c81ae868c3-default-asset-423447

id = bdf73ad5-4499-4f70-b7e3-e2c81ae868c3-default-asset-6672

id = bdf73ad5-4499-4f70-b7e3-e2c81ae868c3-default-asset-4232323

I was using....

| eval stripped_asset_id=substr(id, -6)

  however that only is consistent if the last numbers consist of 6 digits which it often may have more or less.

How can I take everything after the last dash "-"?

[gcusello]

Hi @morgantay96,

you could also try this:

| rex field=id "^([^\-]*\-){7}(?<your_field>\d+)"

that you can test at https://regex101.com/r/dDfGBk/1

Ciao.

Giuseppe

[jnorha · Accepted solution]

Try adding this pipe:

| rex field=id "(?<new_field_name>[^\-]*$)"

This will run a lookbehind from the last dash in the end of the string and create a new field with your new field name. In this case id is a field and the full string is that fields value

[isoutamo]

And if you want to optimise that regex then you can use this if all your id:s have above format.

| rex field=id "t-(?<new_field_name>\d+$)"

https://regex101.com/r/2qGsRf/1 (3 matches 33 steps)

vs. original

 https://regex101.com/r/bhW62a/1 (6 matches 1 354 steps)

No mater if you have only couple of events, but when there are millions or more then this can be meaningful difference.

r. Ismo