How do I extract the latest occurrence of a field from multiple lines?

[nkchaitanya]

Want to capture the latest occurrence of "working_condition_check - status -" which is "Stopped".

Please help me in getting the regex.

Below is the log message.

10/01/2018 15:01:04 Server_Name
working_condition_check - status - Started
working_condition_check - status - Running
working_condition_check - status - Stopped

[harishalipaka]

hi @nkchaitanya

As @493669 answer follow that end of your query add this

| makeresults |eval hari="working_condition_check - status - Stopped" |rex field=hari ".*status - (?<status>\w+)" |where status="Stopped"

[493669]

Hi @nkchaitanya,
Try this:

...|rex ".*status - (?<status>\w+)"