Splunk Search

How to fetch the second last word of a sentence with the Splunk regex?

riginoommen
Explorer

My query is:

 

Mozilla/5.0 (X11; Linux x86_64; Catchpoint) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36

 

I want to extract the following word from the above sting with regex can you please help me.

 

Chrome/87.0.4280.88

 

Labels (1)
0 Karma
1 Solution

somesoni2
Revered Legend

Try like this (replace everything before "rex" command with your search)

|makeresults | eval _raw="Mozilla/5.0 (X11; Linux x86_64; Catchpoint) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36" | table _raw 
| rex "\s+(?<SecondLastPart>\S+)\s+\S+$"

  

View solution in original post

somesoni2
Revered Legend

Try like this (replace everything before "rex" command with your search)

|makeresults | eval _raw="Mozilla/5.0 (X11; Linux x86_64; Catchpoint) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36" | table _raw 
| rex "\s+(?<SecondLastPart>\S+)\s+\S+$"

  

riginoommen
Explorer

This fetched the data as expected but its not taking the filtered data from past output

0 Karma

riginoommen
Explorer

Can you please see the updated question

0 Karma

Stefanie
Builder

Sure

Try this one?

 

\s\S+\/\S+\s(?!\()
0 Karma

Stefanie
Builder

Hi!

Try this Regex.

 

\b(\S+)$

riginoommen
Explorer

How to use the regex with the rex tag

\b(\S+)$
can you please help me
 
0 Karma

riginoommen
Explorer

Can you please see the updated question with the answer and I am trying to accommodate with the res. it will be super awesome if you share the full url

0 Karma
Get Updates on the Splunk Community!

Message Parsing in SOCK

Introduction This blog post is part of an ongoing series on SOCK enablement. In this blog post, I will write ...

Exploring the OpenTelemetry Collector’s Kubernetes annotation-based discovery

We’ve already explored a few topics around observability in a Kubernetes environment -- Common Failures in a ...

Use ‘em or lose ‘em | Splunk training units do expire

Whether it’s hummus, a ham sandwich, or a human, almost everything in this world has an expiration date. And, ...