Splunk Search

use rex to extract last word/number in a line

sriva6
New Member

Hi,

I have logs like theses:

blah blah (Linux+amd64+2.6.18-308.11.1.el5;+Java+HotSpot(TM)+64-Bit+Server+VM+20.5-b03) 200 0 0 8
blah blah (Linux+amd64+2.6.18-308.11.1.el5;+Java+HotSpot(TM)+64-Bit+Server+VM+20.5-b03) 401 2 5 1

I want to extract the last number(s) from the logs. in the above examples I want 8 and 1. How can I do this using rex?

Tags (1)
0 Karma

lsnow
Explorer

This should work if the last field is always numeric - otherwise change the '\d' as appropriate.

| rex "(?<lastfield>\d+$)

hartfoml
Motivator

Ayn, the answer above didn't work for my

I have multiple line log entry and the last line reads like this
[Message=Product: Epicor Administration Console -- Removal completed successfully.]

I want to get the work Successfully without the period.

0 Karma

ppuru
Path Finder

Thank you. This really helped.

0 Karma
Get Updates on the Splunk Community!

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...

[Live Demo] Watch SOC transformation in action with the reimagined Splunk Enterprise ...

Overwhelmed SOC? Splunk ES Has Your Back Tool sprawl, alert fatigue, and endless context switching are making ...

What’s New & Next in Splunk SOAR

Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us on ...