Splunk Search

How do I extract last two fields of a string separated by a delimiter?

masfar
Engager

Hi- I have some strings separated by "." delimiter. For example,
a.b.c.d
x.y.z
p.q.r.s.t.u

I want to be able to extract the last two fields with the delimiter. So, I want my output to be:
c.d
y.z
t.u

Is there a method to perform such action?
Thanks,
MA

Tags (1)
0 Karma
1 Solution

gokadroid
Motivator

How about trying this, let's say your data is in field myField which has strings like w.x.y.z

your query to return events
| eval splitString=split(myField, ".")
| eval count=mvcount(splitString)
| eval requiredString=mvindex( splitString, count-2).".".mvindex(splitString, count-1)
| table requiredString

View solution in original post

somesoni2
Revered Legend

An alternative command (rex). Assuming dot as delimiter. Regex might need updates based on type of values the string between delimiter contains.

your base search | rex field=myField "\.(?<requiredString>\w+\.\w+)$" | table myField requiredString

masfar
Engager

Thanks, somesoni2!

0 Karma

anshu
Path Finder

Building on somesoni2's expression, this would allow for any characters other than the delimiter:

your base search | rex field=myField "\.(?<requiredString>[^.]+\.[^.]+)$" | table myField requiredString

gokadroid
Motivator

How about trying this, let's say your data is in field myField which has strings like w.x.y.z

your query to return events
| eval splitString=split(myField, ".")
| eval count=mvcount(splitString)
| eval requiredString=mvindex( splitString, count-2).".".mvindex(splitString, count-1)
| table requiredString

masfar
Engager

Thanks, that works!

0 Karma

anshu
Path Finder

This can also work, saves the "eval count=mvcount(splitstring)" clause
| eval splitString=split(myField, ".")
| eval requiredString=mvindex(splitString, -2).".".mvindex(splitString, -1)
| table requiredString

It appears the mvindex list can use negative indices to start from the end of the list.

Get Updates on the Splunk Community!

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...

Major Splunk Upgrade – Prepare your Environment for Splunk 10 Now!

Attention App Developers: Test Your Apps with the Splunk 10.0 Beta and Ensure Compatibility Before the ...

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...