How to develop a regular expression to extract the last value in delimited list?

[rweldy]

I have the following event and I'm trying to pull out the last occurrence of the service_x call. I've named them service_x because I won't know how many services get called within the event. But in this example, I would like "service_9" to be returned so that I can build a table on it. Is there a way to do that?

Thrift: [service_1: (74.400232 ms)|service_2: (202.680038 ms)|service_3: (165.498747 ms)|service_4: (184.461466 ms)|service_5: (298.359583 ms)|service_6: (525.498376 ms)|service_7: (737.382805 ms)|service_8: (709.533687 ms)|service_9: (8960.064359 ms)])

[adamsaul · Accepted solution]

rweldy,

This should get you the last service every time:
(?<=\|)(?<last_service>\w+)(?=:\s+\(\d+.\d+\s+ms\)\]\)$)

[rweldy]

Thank you, exactly what I needed!

[adamsaul]

You're welcome! Glad it worked for you!

[gokadroid]

How about trying this:

your query to return events
| rex field=_raw "\|(?<lastServiceName>[^\:]+)\:\s+\((?<timeInMs>\d+\.\d+)\sms\)\]\)$"
| table lastServiceName, timeInMs

See extraction here

[rweldy]

Thank you, this worked out well too!

[sundareshr]

Try this
UPDATED

.... | rex "\|(?<last_service>[\w\d]+):\s\((?<time>\d+\.\d+)\sms\)\]\)$"

[rweldy]

Thanks for the response, but looks like that pulls out the time in ms. I'm looking to pull out the actual service name like "service_9". I may be able to use this to get a little closer though.

[sundareshr]

Misunderstood. The updated includes service name as well.