Splunk Search

How to develop a regular expression to extract the last value in delimited list?

rweldy
New Member

I have the following event and I'm trying to pull out the last occurrence of the service_x call. I've named them service_x because I won't know how many services get called within the event. But in this example, I would like "service_9" to be returned so that I can build a table on it. Is there a way to do that?

Thrift: [service_1: (74.400232 ms)|service_2: (202.680038 ms)|service_3: (165.498747 ms)|service_4: (184.461466 ms)|service_5: (298.359583 ms)|service_6: (525.498376 ms)|service_7: (737.382805 ms)|service_8: (709.533687 ms)|service_9: (8960.064359 ms)])
0 Karma
1 Solution

adamsaul
Communicator

rweldy,

This should get you the last service every time:
(?<=\|)(?<last_service>\w+)(?=:\s+\(\d+.\d+\s+ms\)\]\)$)

View solution in original post

0 Karma

adamsaul
Communicator

rweldy,

This should get you the last service every time:
(?<=\|)(?<last_service>\w+)(?=:\s+\(\d+.\d+\s+ms\)\]\)$)

View solution in original post

0 Karma

rweldy
New Member

Thank you, exactly what I needed!

0 Karma

adamsaul
Communicator

You're welcome! Glad it worked for you!

0 Karma

gokadroid
Motivator

How about trying this:

your query to return events
| rex field=_raw "\|(?<lastServiceName>[^\:]+)\:\s+\((?<timeInMs>\d+\.\d+)\sms\)\]\)$"
| table lastServiceName, timeInMs

See extraction here

0 Karma

rweldy
New Member

Thank you, this worked out well too!

0 Karma

sundareshr
Legend

Try this
UPDATED

.... | rex "\|(?<last_service>[\w\d]+):\s\((?<time>\d+\.\d+)\sms\)\]\)$"
0 Karma

rweldy
New Member

Thanks for the response, but looks like that pulls out the time in ms. I'm looking to pull out the actual service name like "service_9". I may be able to use this to get a little closer though.

0 Karma

sundareshr
Legend

Misunderstood. The updated includes service name as well.

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!