How to fetch the second last word of a sentence with the Splunk regex?

[riginoommen]

My query is:

Mozilla/5.0 (X11; Linux x86_64; Catchpoint) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36

I want to extract the following word from the above sting with regex can you please help me.

Chrome/87.0.4280.88

[somesoni2 · Accepted solution]

Try like this (replace everything before "rex" command with your search)

|makeresults | eval _raw="Mozilla/5.0 (X11; Linux x86_64; Catchpoint) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36" | table _raw 
| rex "\s+(?<SecondLastPart>\S+)\s+\S+$"

[riginoommen]

This fetched the data as expected but its not taking the filtered data from past output

[riginoommen]

Can you please see the updated question

[Stefanie]

Sure

Try this one?

\s\S+\/\S+\s(?!\()

[Stefanie]

Hi!

Try this Regex.

\b(\S+)$

[riginoommen]

How to use the regex with the rex tag

\b(\S+)$

can you please help me

[riginoommen]

Can you please see the updated question with the answer and I am trying to accommodate with the res. it will be super awesome if you share the full url