Splunk Search
Highlighted

How to perform regex on latest event?

Loves-to-Learn

I have a query statement like so

 

 

 

index=* "account balance:" | rex "blah blah account balance:(?P<balance>(\d{1,3}(,\d{3})*)+) " | table balance

 

 

 

And this works fine, but when I try to add `latest` In there, it gives no results.

 

 

 

index=* "account balance:" | stats latest() | rex "blah blah account balance:(?P<balance>(\d{1,3}(,\d{3})*)+) " | table balance

 

 

 

Why am I not able to perform regex on the latest event?

Labels (1)
Tags (4)
0 Karma
Highlighted

Re: How to perform regex on latest event?

SplunkTrust
SplunkTrust
The latest() function requires an argument. Put a field name within the parentheses.
---
If this reply helps you, an upvote would be appreciated.
0 Karma
Highlighted

Re: How to perform regex on latest event?

Ultra Champion

sample:

index=_internal | head 2
| rex "(?P<balance>(\d{1,3}(,\d{3})*)+)" | table balance
| eval note="no_stats"
| append [ search index=_internal | head 2 |stats latest(_time) as _raw
| rex "(?P<balance>(\d{1,3}(,\d{3})*)+)" | eval note="default_latest"]
| append [ search index=_internal | head 2 |stats latest(_time) as test
| rex field=test "(?P<balance>(\d{1,3}(,\d{3})*)+)" | eval note="rename_latest"]

rex extracts fields in _raw by default.  try field= option.

0 Karma