Splunk Search

How to rex extract two last word?

indeed_2000
Builder

Hi how can I extract only last 2 word that exist in className

I have log like this:

2022-05-24 16:29:51,918 INFO [APP] [ActionName] className[xx.xx.xxx.xxxx.xxx.session.controller.SearchClusterFinancialTcpMBean.search] status[done]

2022-05-24 16:29:51,918 INFO [APP] [ActionName] className[xx.xx.xxx.xxxx.xxx.session.controller.SearchClusterFinancialTcpMBean.search.attribute] status[done]

 

excpected output:

SearchClusterFinancialTcpMBean.search

search.attribute

 

Any idea?

Thanks,

Labels (3)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

This regular expression should do it.

className\[.*?(?<lastTwo>[^\.]+\.[^\.]+?)]
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| rex "className.*\.(?<class>\w+\.\w+)\]"
0 Karma

richgalloway
SplunkTrust
SplunkTrust

This regular expression should do it.

className\[.*?(?<lastTwo>[^\.]+\.[^\.]+?)]
---
If this reply helps you, an upvote would be appreciated.
Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

<P style=" text-align: center; "><span class="lia-inline-image-display-wrapper lia-image-align-center" ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

<FONT size="5"><FONT size="5" color="#FF00FF">Get the latest news and updates from the Splunk Community ...