Show last part of a result after a /

[kemnean2001]

A result of a search for a field resourceId is

/SUBSCRIPTIONS/9B8874C9-5DC3-46CE-908A-D00EE594A4EC/PROVIDERS/MICROSOFT.SECURITY/LOCATIONS/WESTEUROPE/ALERTS/2518432613670999141_1736EDA9-63D3-4CD2-8E54-79828127B011

I only want to see the result after the last /
So: 2518432613670999141_1736EDA9-63D3-4CD2-8E54-79828127B011

What's the way to do this?

[richgalloway]

Use the rex command. Here is one way. others may find a better one.

... | rex "(?:\/[^\/]+)+\/(?<field>.*?$)" | ...

[kemnean2001]

Tx...this helps indeed
Martin

[richgalloway]

If your problem is resolved, please accept the answer to help future readers.