Splunk Search

Need help creating a regex to grab anything after last comma

mikehage
New Member

Hi,

Hope someone can help me with creating a regular expression for an extraction. I have a log file and the lines don't all have the same amount of information,but the information after the last comma always relates to the same field. I need to create a regular expression to associate anything after the last comma with an event type. When I try to do this without writing the regular expression it does not work for all lines.

Hope someone can help, let me know if you need more information.

here is a sample line:

"WBS","20150617131035-any-96095",701,0,"20150617171035Z","10.183.56.173",3,0,"","http://10.183.56.173:10021/mmsc/direct","","M-default","P-default",8799,3367,27,0,0,0,0,0,116,"",0,"",0,"","text/plain","iPhoneOS/8.3 (12F70)",200

So i would want to grab the "200" in this line but it's not always 200.

Thanks,
Mike

Tags (2)
0 Karma

woodcock
Esteemed Legend

Like this:

... | rex ",(?<status>[^,]*)$"
0 Karma

aljohnson_splun
Splunk Employee
Splunk Employee
... | rex ",(?<status>\d+)$"
0 Karma

tcottreau
Explorer

If the last field is non-numeric, you will miss it. richgalloway above gave a nice, simple solution, i.e. match all non-comma characters up to the last comma in the line.

0 Karma

mikehage
New Member

here is a sample line:

"WBS","20150617131035-any-96095",701,0,"20150617171035Z","10.183.56.173",3,0,"","http://10.183.56.173:10021/mmsc/direct","","M-default","P-default",8799,3367,27,0,0,0,0,0,116,"",0,"... (12F70)",200

So i would want to grab the "200" in this line but it's not always 200.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The regex string in my answer should do it.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

A sample of your data would be useful, this will probably get you started.

.. | rex ",(?P<field>[^,]*?)$" | ...
---
If this reply helps you, an upvote would be appreciated.