Splunk Search

How do I extract last two fields of a string separated by a delimiter?

masfar
Engager

Hi- I have some strings separated by "." delimiter. For example,
a.b.c.d
x.y.z
p.q.r.s.t.u

I want to be able to extract the last two fields with the delimiter. So, I want my output to be:
c.d
y.z
t.u

Is there a method to perform such action?
Thanks,
MA

Tags (1)
0 Karma
1 Solution

gokadroid
Motivator

How about trying this, let's say your data is in field myField which has strings like w.x.y.z

your query to return events
| eval splitString=split(myField, ".")
| eval count=mvcount(splitString)
| eval requiredString=mvindex( splitString, count-2).".".mvindex(splitString, count-1)
| table requiredString

View solution in original post

somesoni2
Revered Legend

An alternative command (rex). Assuming dot as delimiter. Regex might need updates based on type of values the string between delimiter contains.

your base search | rex field=myField "\.(?<requiredString>\w+\.\w+)$" | table myField requiredString

masfar
Engager

Thanks, somesoni2!

0 Karma

anshu
Path Finder

Building on somesoni2's expression, this would allow for any characters other than the delimiter:

your base search | rex field=myField "\.(?<requiredString>[^.]+\.[^.]+)$" | table myField requiredString

gokadroid
Motivator

How about trying this, let's say your data is in field myField which has strings like w.x.y.z

your query to return events
| eval splitString=split(myField, ".")
| eval count=mvcount(splitString)
| eval requiredString=mvindex( splitString, count-2).".".mvindex(splitString, count-1)
| table requiredString

masfar
Engager

Thanks, that works!

0 Karma

anshu
Path Finder

This can also work, saves the "eval count=mvcount(splitstring)" clause
| eval splitString=split(myField, ".")
| eval requiredString=mvindex(splitString, -2).".".mvindex(splitString, -1)
| table requiredString

It appears the mvindex list can use negative indices to start from the end of the list.

Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...