Splunk Search

use rex to extract last word/number in a line

sriva6
New Member

Hi,

I have logs like theses:

blah blah (Linux+amd64+2.6.18-308.11.1.el5;+Java+HotSpot(TM)+64-Bit+Server+VM+20.5-b03) 200 0 0 8
blah blah (Linux+amd64+2.6.18-308.11.1.el5;+Java+HotSpot(TM)+64-Bit+Server+VM+20.5-b03) 401 2 5 1

I want to extract the last number(s) from the logs. in the above examples I want 8 and 1. How can I do this using rex?

Tags (1)
0 Karma

lsnow
Explorer

This should work if the last field is always numeric - otherwise change the '\d' as appropriate.

| rex "(?<lastfield>\d+$)

hartfoml
Motivator

Ayn, the answer above didn't work for my

I have multiple line log entry and the last line reads like this
[Message=Product: Epicor Administration Console -- Removal completed successfully.]

I want to get the work Successfully without the period.

0 Karma

ppuru
Path Finder

Thank you. This really helped.

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...