Splunk Search

Help with regex on string with multiple number values

morgantay96
Path Finder

Hi all need help getting the trailing number from a field in a search.

Examples of the field

id = bdf73ad5-4499-4f70-b7e3-e2c81ae868c3-default-asset-423447

id = bdf73ad5-4499-4f70-b7e3-e2c81ae868c3-default-asset-6672

id = bdf73ad5-4499-4f70-b7e3-e2c81ae868c3-default-asset-4232323

I was using....

 

 

 

 

| eval stripped_asset_id=substr(id, -6)

 

 

 

 

  however that only is consistent if the last numbers consist of 6 digits which it often may have more or less.

How can I take everything after the last dash "-"?

Labels (1)
0 Karma
1 Solution

jnorha
Engager

Try adding this pipe:

 

| rex field=id "(?<new_field_name>[^\-]*$)"

 

This will run a lookbehind from the last dash in the end of the string and create a new field with your new field name. In this case id is a field and the full string is that fields value

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @morgantay96,

you could also try this:

| rex field=id "^([^\-]*\-){7}(?<your_field>\d+)"

that you can test at https://regex101.com/r/dDfGBk/1

Ciao.

Giuseppe

0 Karma

jnorha
Engager

Try adding this pipe:

 

| rex field=id "(?<new_field_name>[^\-]*$)"

 

This will run a lookbehind from the last dash in the end of the string and create a new field with your new field name. In this case id is a field and the full string is that fields value

isoutamo
SplunkTrust
SplunkTrust

And if you want to optimise that regex then you can use this if all your id:s have above format.

| rex field=id "t-(?<new_field_name>\d+$)"

https://regex101.com/r/2qGsRf/1 (3 matches 33 steps)

vs. original

 https://regex101.com/r/bhW62a/1 (6 matches 1 354 steps)

No mater if you have only couple of events, but when there are millions or more then this can be meaningful difference.

r. Ismo

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...