How to Extract a Part of the field in splunk

[chavi]

Hi Everyone,

It would be great if someone help me on this.

I am having one field URL in my raw data.

URL = https://jfghdw.ind.com:1001/xyz/flow/group/186yugh-w12-567c-b89-pghj67y

Now I want to extract only the last portion(that will be different for each URL so Cant take hard coded value) of the field URL 

How to extract the 6th portion of the field that is "186yugh-w12-567c-b89-pghj67y" (It will be different for each URL)

using regular expression.

[bquirin]

Hi Chavi, 

Is the URL always going to be the same?

If that is the case you could use the following: regular expression:

If the URL is dynamic in each event then its probably best to use a multi value eval function like mvindex:

If you have any more question do not hesitate to respond.

Best regards, 

bquirin

[to4kawa]

| eval result=mvindex(split(URL,"/"),-1)