How to extract the last underscore part of a field?

[Splunkster45]

I have a value a_b_c. How do I extract the last '_' item. So in this case it'd be 'c'. The number of of underscores in the field can change. I need the last one.

[xpac · Accepted solution]

Try this:

| makeresults
| eval oldfield="adsfesaf_sfdasdf_sdfsadf_243rfsa"
| rex field=oldfield "_(?<newfield>[^_]+)$"

Hope that helps - if it does I'd be happy if you would upvote/accept this answer, so others could profit from it. 🙂

[Splunkster45]

Works like a charm. Thank you!