Splunk Search

use rex to extract last word/number in a line

sriva6
New Member

Hi,

I have logs like theses:

blah blah (Linux+amd64+2.6.18-308.11.1.el5;+Java+HotSpot(TM)+64-Bit+Server+VM+20.5-b03) 200 0 0 8
blah blah (Linux+amd64+2.6.18-308.11.1.el5;+Java+HotSpot(TM)+64-Bit+Server+VM+20.5-b03) 401 2 5 1

I want to extract the last number(s) from the logs. in the above examples I want 8 and 1. How can I do this using rex?

Tags (1)
0 Karma

lsnow
Explorer

This should work if the last field is always numeric - otherwise change the '\d' as appropriate.

| rex "(?<lastfield>\d+$)

hartfoml
Motivator

Ayn, the answer above didn't work for my

I have multiple line log entry and the last line reads like this
[Message=Product: Epicor Administration Console -- Removal completed successfully.]

I want to get the work Successfully without the period.

0 Karma

ppuru
Path Finder

Thank you. This really helped.

0 Karma
Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...