Splunk Search

Need help creating a regex to grab anything after last comma

mikehage
New Member

Hi,

Hope someone can help me with creating a regular expression for an extraction. I have a log file and the lines don't all have the same amount of information,but the information after the last comma always relates to the same field. I need to create a regular expression to associate anything after the last comma with an event type. When I try to do this without writing the regular expression it does not work for all lines.

Hope someone can help, let me know if you need more information.

here is a sample line:

"WBS","20150617131035-any-96095",701,0,"20150617171035Z","10.183.56.173",3,0,"","http://10.183.56.173:10021/mmsc/direct","","M-default","P-default",8799,3367,27,0,0,0,0,0,116,"",0,"",0,"","text/plain","iPhoneOS/8.3 (12F70)",200

So i would want to grab the "200" in this line but it's not always 200.

Thanks,
Mike

Tags (2)
0 Karma

woodcock
Esteemed Legend

Like this:

... | rex ",(?<status>[^,]*)$"
0 Karma

aljohnson_splun
Splunk Employee
Splunk Employee
... | rex ",(?<status>\d+)$"
0 Karma

tcottreau
Explorer

If the last field is non-numeric, you will miss it. richgalloway above gave a nice, simple solution, i.e. match all non-comma characters up to the last comma in the line.

0 Karma

mikehage
New Member

here is a sample line:

"WBS","20150617131035-any-96095",701,0,"20150617171035Z","10.183.56.173",3,0,"","http://10.183.56.173:10021/mmsc/direct","","M-default","P-default",8799,3367,27,0,0,0,0,0,116,"",0,"... (12F70)",200

So i would want to grab the "200" in this line but it's not always 200.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The regex string in my answer should do it.

---
If this reply helps you, Karma would be appreciated.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

A sample of your data would be useful, this will probably get you started.

.. | rex ",(?P<field>[^,]*?)$" | ...
---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...