Splunk Search

How Do I Extract The End of String

IRHM73
Motivator

Hi, I wonder whether someone may be able to help me please.

From a field called 'detail.input' there are two potential outputs as shown below:

Request to /for/submissions/1234567890 and Request to /for/savedforlater/9876543210

What I'd like to do is extract the number at the end of the string.

I'd thought about using a regex, but because of the difference in the string, i.e. "submissions" as opposed to "savedforlater", I wasn't sure whether this could be done, so I wondered if I could the 'str' and 'len' commands.

I know how to omit the end of the character string, but I was wondering whether someone may be able to provide some guidance please how I can extract the end of the character string.

Many thanks and kind regards

Chris

0 Karma
1 Solution

javiergn
Super Champion

Something like this should do the trick (not tested):

rex "\/(?<mynumber>\d+)$"

If the number is not the last part of your string then I can provide something different.

View solution in original post

javiergn
Super Champion

Something like this should do the trick (not tested):

rex "\/(?<mynumber>\d+)$"

If the number is not the last part of your string then I can provide something different.

IRHM73
Motivator

Hi @javiergn, thank you for taking the time to reply to my post.

The solution works great, but so that I can improve my understanding, could you perhaps explain what the rex is doing?

Many thanks and kind regards

Chris

0 Karma

ziegfried
Influencer

Check out the explanation here: https://regex101.com/r/eY4cN2/1 (tab on the right hand side)

IRHM73
Motivator

Ah, thanks for that @ziegfried.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...