Splunk Search

Required robust regex to fetch the last value of the log events.

New Member

I need a regex which will fetch the last value of log events ends with [abcd].
Currently the challenge i'm facing here is my log events.
Here the sample log has 2 lines , next will have 4 lines, next 10 lines and so on...
I need a robust regex which will fetch the last value here the value is 4.

My initial regex : ^(?:[^[\n]*[){4}(?P<test>[^]]+)

Sample log event :
2016-01-13 05:39:12.413Z [Rabbit listener thread] [finance] INFO [c.t.events.EventDemultiplexer] finance event demultiplexer completed event processing [LB-g6yp6980-j4as-w1sc-nhc4-n9gnryla8s7o]

Kindly help!

Tags (1)
0 Karma

Splunk Employee
Splunk Employee

I wasn't sure exactly which 4 you meant. This gets the 4 of nhc4. \s+\[\w+-[^-]+[^-]+-[^-]+-[^-]+-\w{3}(?[^-]+)[^\n]+$

0 Karma


Either anchor your regex to the end with$ instead of the beginning, and get the last bracketed string (also likely no need for repetition, but that's a function of what you need to validate in extracting), or depending on your use case you could remove the anchor and repetition completely and extract all bracketed strings into a multi-valued field (rex command use max_match=0 or in transforms.conf check out MV_ADD) then using multivalue eval functions pull out the last value.

0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out &gt;&gt; As our brave ...