Splunk Search

Rex command help

mpk_24
Explorer

Hey @Splunkers,

Looking for valuable insights for this use case.

 

I wanted to extract the numbers at the end of the log (highlighted in bold). Pls help.

Sample log:

74.133.120.000 - LASTHOP:142.136.168.1 - [19/May/2025:23:30:12 +0000] "GET /content/*/residential.existingCustomerProfileLoader.json HTTP/1.1" 200 143 "/cp/activate-apps?cmp=dotcom_sms_selectapps_111324" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Mobile Safari/537.36" 384622

Labels (1)
0 Karma
1 Solution

liangliang
Explorer

you can try this   (?P<number>\d+)$  
the $ will match the end of this line

View solution in original post

mpk_24
Explorer

@liangliang thank you so much for your respond. This works. Appreciate very much.  

0 Karma

liangliang
Explorer

you can try this   (?P<number>\d+)$  
the $ will match the end of this line

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Casting Call: Compete in Cyber Games

Lights, Camera, SecOps: Apply to Compete in Cyber Games     Think you have what it takes to beat the clock? ...

Data Management Digest – June 2026

Welcome to the June 2026 edition of Data Management Digest! This month’s update is short and sweet, with a ...

Think Like an Architect: Introducing the Splunk Certified Cybersecurity Defense ...

In cybersecurity, defenders respond to threats. Architects design the systems that stop them.    As ...