Splunk Search

How to Extract a Part of the field in splunk


Hi Everyone,

It would be great if someone help me on this.

I am having one field URL in my raw data.

URL = https://jfghdw.ind.com:1001/xyz/flow/group/186yugh-w12-567c-b89-pghj67y

Now I want to extract only the last portion(that will be different for each URL so Cant take hard coded value) of the field URL 

How to extract the 6th portion of the field that is "186yugh-w12-567c-b89-pghj67y" (It will be different for each URL)

using regular expression.


Labels (3)


Hi Chavi, 

Is the URL always going to be the same?

If that is the case you could use the following: regular expression:



If the URL is dynamic in each event then its probably best to use a multi value eval function like mvindex:



If you have any more question do not hesitate to respond.

Best regards, 


0 Karma

Ultra Champion

| eval result=mvindex(split(URL,"/"),-1)

Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...