Splunk Search

Help with regex on string with multiple number values

morgantay96
Path Finder

Hi all need help getting the trailing number from a field in a search.

Examples of the field

id = bdf73ad5-4499-4f70-b7e3-e2c81ae868c3-default-asset-423447

id = bdf73ad5-4499-4f70-b7e3-e2c81ae868c3-default-asset-6672

id = bdf73ad5-4499-4f70-b7e3-e2c81ae868c3-default-asset-4232323

I was using....

 

 

 

 

| eval stripped_asset_id=substr(id, -6)

 

 

 

 

  however that only is consistent if the last numbers consist of 6 digits which it often may have more or less.

How can I take everything after the last dash "-"?

Labels (1)
0 Karma
1 Solution

jnorha
Engager

Try adding this pipe:

 

| rex field=id "(?<new_field_name>[^\-]*$)"

 

This will run a lookbehind from the last dash in the end of the string and create a new field with your new field name. In this case id is a field and the full string is that fields value

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @morgantay96,

you could also try this:

| rex field=id "^([^\-]*\-){7}(?<your_field>\d+)"

that you can test at https://regex101.com/r/dDfGBk/1

Ciao.

Giuseppe

0 Karma

jnorha
Engager

Try adding this pipe:

 

| rex field=id "(?<new_field_name>[^\-]*$)"

 

This will run a lookbehind from the last dash in the end of the string and create a new field with your new field name. In this case id is a field and the full string is that fields value

isoutamo
SplunkTrust
SplunkTrust

And if you want to optimise that regex then you can use this if all your id:s have above format.

| rex field=id "t-(?<new_field_name>\d+$)"

https://regex101.com/r/2qGsRf/1 (3 matches 33 steps)

vs. original

 https://regex101.com/r/bhW62a/1 (6 matches 1 354 steps)

No mater if you have only couple of events, but when there are millions or more then this can be meaningful difference.

r. Ismo

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...