Splunk Search

How do I extract last two fields of a string separated by a delimiter?

masfar
Engager

Hi- I have some strings separated by "." delimiter. For example,
a.b.c.d
x.y.z
p.q.r.s.t.u

I want to be able to extract the last two fields with the delimiter. So, I want my output to be:
c.d
y.z
t.u

Is there a method to perform such action?
Thanks,
MA

Tags (1)
0 Karma
1 Solution

gokadroid
Motivator

How about trying this, let's say your data is in field myField which has strings like w.x.y.z

your query to return events
| eval splitString=split(myField, ".")
| eval count=mvcount(splitString)
| eval requiredString=mvindex( splitString, count-2).".".mvindex(splitString, count-1)
| table requiredString

View solution in original post

somesoni2
Revered Legend

An alternative command (rex). Assuming dot as delimiter. Regex might need updates based on type of values the string between delimiter contains.

your base search | rex field=myField "\.(?<requiredString>\w+\.\w+)$" | table myField requiredString

masfar
Engager

Thanks, somesoni2!

0 Karma

anshu
Path Finder

Building on somesoni2's expression, this would allow for any characters other than the delimiter:

your base search | rex field=myField "\.(?<requiredString>[^.]+\.[^.]+)$" | table myField requiredString

gokadroid
Motivator

How about trying this, let's say your data is in field myField which has strings like w.x.y.z

your query to return events
| eval splitString=split(myField, ".")
| eval count=mvcount(splitString)
| eval requiredString=mvindex( splitString, count-2).".".mvindex(splitString, count-1)
| table requiredString

masfar
Engager

Thanks, that works!

0 Karma

anshu
Path Finder

This can also work, saves the "eval count=mvcount(splitstring)" clause
| eval splitString=split(myField, ".")
| eval requiredString=mvindex(splitString, -2).".".mvindex(splitString, -1)
| table requiredString

It appears the mvindex list can use negative indices to start from the end of the list.

Get Updates on the Splunk Community!

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...

The Visibility Gap: Hybrid Networks and IT Services

The most forward thinking enterprises among us see their network as much more than infrastructure – it's their ...

Get Operational Insights Quickly with Natural Language on the Splunk Platform

In today’s fast-paced digital world, turning data into actionable insights is essential for success. With ...