Splunk Search

How to fetch the second last word of a sentence with the Splunk regex?

riginoommen
Explorer

My query is:

 

Mozilla/5.0 (X11; Linux x86_64; Catchpoint) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36

 

I want to extract the following word from the above sting with regex can you please help me.

 

Chrome/87.0.4280.88

 

Labels (1)
0 Karma
1 Solution

somesoni2
Revered Legend

Try like this (replace everything before "rex" command with your search)

|makeresults | eval _raw="Mozilla/5.0 (X11; Linux x86_64; Catchpoint) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36" | table _raw 
| rex "\s+(?<SecondLastPart>\S+)\s+\S+$"

  

View solution in original post

somesoni2
Revered Legend

Try like this (replace everything before "rex" command with your search)

|makeresults | eval _raw="Mozilla/5.0 (X11; Linux x86_64; Catchpoint) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36" | table _raw 
| rex "\s+(?<SecondLastPart>\S+)\s+\S+$"

  

riginoommen
Explorer

This fetched the data as expected but its not taking the filtered data from past output

0 Karma

riginoommen
Explorer

Can you please see the updated question

0 Karma

Stefanie
Builder

Sure

Try this one?

 

\s\S+\/\S+\s(?!\()
0 Karma

Stefanie
Builder

Hi!

Try this Regex.

 

\b(\S+)$

riginoommen
Explorer

How to use the regex with the rex tag

\b(\S+)$
can you please help me
 
0 Karma

riginoommen
Explorer

Can you please see the updated question with the answer and I am trying to accommodate with the res. it will be super awesome if you share the full url

0 Karma
Get Updates on the Splunk Community!

New Dates, New City: Save the Date for .conf25!

Wake up, babe! New .conf25 dates AND location just dropped!! That's right, this year, .conf25 is taking place ...

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...