Splunk Search

How to fetch the second last word of a sentence with the Splunk regex?

riginoommen
Explorer

My query is:

 

Mozilla/5.0 (X11; Linux x86_64; Catchpoint) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36

 

I want to extract the following word from the above sting with regex can you please help me.

 

Chrome/87.0.4280.88

 

Labels (1)
0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Try like this (replace everything before "rex" command with your search)

|makeresults | eval _raw="Mozilla/5.0 (X11; Linux x86_64; Catchpoint) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36" | table _raw 
| rex "\s+(?<SecondLastPart>\S+)\s+\S+$"

  

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

Try like this (replace everything before "rex" command with your search)

|makeresults | eval _raw="Mozilla/5.0 (X11; Linux x86_64; Catchpoint) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36" | table _raw 
| rex "\s+(?<SecondLastPart>\S+)\s+\S+$"

  

riginoommen
Explorer

This fetched the data as expected but its not taking the filtered data from past output

0 Karma

riginoommen
Explorer

Can you please see the updated question

0 Karma

Stefanie
Builder

Sure

Try this one?

 

\s\S+\/\S+\s(?!\()
0 Karma

Stefanie
Builder

Hi!

Try this Regex.

 

\b(\S+)$

riginoommen
Explorer

How to use the regex with the rex tag

\b(\S+)$
can you please help me
 
0 Karma

riginoommen
Explorer

Can you please see the updated question with the answer and I am trying to accommodate with the res. it will be super awesome if you share the full url

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...