Need help creating a regex to grab anything after last comma

[mikehage]

Hi,

Hope someone can help me with creating a regular expression for an extraction. I have a log file and the lines don't all have the same amount of information,but the information after the last comma always relates to the same field. I need to create a regular expression to associate anything after the last comma with an event type. When I try to do this without writing the regular expression it does not work for all lines.

Hope someone can help, let me know if you need more information.

here is a sample line:

"WBS","20150617131035-any-96095",701,0,"20150617171035Z","10.183.56.173",3,0,"","http://10.183.56.173:10021/mmsc/direct","","M-default","P-default",8799,3367,27,0,0,0,0,0,116,"",0,"",0,"","text/plain","iPhoneOS/8.3 (12F70)",200

So i would want to grab the "200" in this line but it's not always 200.

Thanks,
Mike

[woodcock]

Like this:

... | rex ",(?<status>[^,]*)$"

[aljohnson_splun]

... | rex ",(?<status>\d+)$"

[tcottreau]

If the last field is non-numeric, you will miss it. richgalloway above gave a nice, simple solution, i.e. match all non-comma characters up to the last comma in the line.

[mikehage]

here is a sample line:

"WBS","20150617131035-any-96095",701,0,"20150617171035Z","10.183.56.173",3,0,"","http://10.183.56.173:10021/mmsc/direct","","M-default","P-default",8799,3367,27,0,0,0,0,0,116,"",0,"... (12F70)",200

So i would want to grab the "200" in this line but it's not always 200.

[richgalloway]

The regex string in my answer should do it.

[richgalloway]

A sample of your data would be useful, this will probably get you started.

.. | rex ",(?P<field>[^,]*?)$" | ...