Splunk Search

Show last part of a result after a /

kemnean2001
New Member

A result of a search for a field resourceId is

/SUBSCRIPTIONS/9B8874C9-5DC3-46CE-908A-D00EE594A4EC/PROVIDERS/MICROSOFT.SECURITY/LOCATIONS/WESTEUROPE/ALERTS/2518432613670999141_1736EDA9-63D3-4CD2-8E54-79828127B011

I only want to see the result after the last /
So: 2518432613670999141_1736EDA9-63D3-4CD2-8E54-79828127B011

What's the way to do this?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Use the rex command. Here is one way. others may find a better one.

... | rex "(?:\/[^\/]+)+\/(?<field>.*?$)" | ...
---
If this reply helps you, an upvote would be appreciated.
0 Karma

kemnean2001
New Member

Tx...this helps indeed
Martin

0 Karma

richgalloway
SplunkTrust
SplunkTrust

If your problem is resolved, please accept the answer to help future readers.

---
If this reply helps you, an upvote would be appreciated.
0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!