Splunk Search

use rex to extract last word/number in a line

sriva6
New Member

Hi,

I have logs like theses:

blah blah (Linux+amd64+2.6.18-308.11.1.el5;+Java+HotSpot(TM)+64-Bit+Server+VM+20.5-b03) 200 0 0 8
blah blah (Linux+amd64+2.6.18-308.11.1.el5;+Java+HotSpot(TM)+64-Bit+Server+VM+20.5-b03) 401 2 5 1

I want to extract the last number(s) from the logs. in the above examples I want 8 and 1. How can I do this using rex?

Tags (1)
0 Karma

lsnow
Explorer

This should work if the last field is always numeric - otherwise change the '\d' as appropriate.

| rex "(?<lastfield>\d+$)

hartfoml
Motivator

Ayn, the answer above didn't work for my

I have multiple line log entry and the last line reads like this
[Message=Product: Epicor Administration Console -- Removal completed successfully.]

I want to get the work Successfully without the period.

0 Karma

ppuru
Path Finder

Thank you. This really helped.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...