Splunk Search

How to rex extract two last word?

indeed_2000
Motivator

Hi how can I extract only last 2 word that exist in className

I have log like this:

2022-05-24 16:29:51,918 INFO [APP] [ActionName] className[xx.xx.xxx.xxxx.xxx.session.controller.SearchClusterFinancialTcpMBean.search] status[done]

2022-05-24 16:29:51,918 INFO [APP] [ActionName] className[xx.xx.xxx.xxxx.xxx.session.controller.SearchClusterFinancialTcpMBean.search.attribute] status[done]

 

excpected output:

SearchClusterFinancialTcpMBean.search

search.attribute

 

Any idea?

Thanks,

Labels (3)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

This regular expression should do it.

className\[.*?(?<lastTwo>[^\.]+\.[^\.]+?)]
---
If this reply helps you, Karma would be appreciated.

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| rex "className.*\.(?<class>\w+\.\w+)\]"
0 Karma

richgalloway
SplunkTrust
SplunkTrust

This regular expression should do it.

className\[.*?(?<lastTwo>[^\.]+\.[^\.]+?)]
---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...