Splunk Search

How to Extract a Part of the field in splunk


Hi Everyone,

It would be great if someone help me on this.

I am having one field URL in my raw data.

URL = https://jfghdw.ind.com:1001/xyz/flow/group/186yugh-w12-567c-b89-pghj67y

Now I want to extract only the last portion(that will be different for each URL so Cant take hard coded value) of the field URL 

How to extract the 6th portion of the field that is "186yugh-w12-567c-b89-pghj67y" (It will be different for each URL)

using regular expression.


Labels (3)


Hi Chavi, 

Is the URL always going to be the same?

If that is the case you could use the following: regular expression:



If the URL is dynamic in each event then its probably best to use a multi value eval function like mvindex:



If you have any more question do not hesitate to respond.

Best regards, 


0 Karma


| eval result=mvindex(split(URL,"/"),-1)

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!