Splunk Search

How to extract last words?

akshayinnamuri
Loves-to-Learn Lots

Hi I have sample like this

Source                                                                      
Sample time from tx-templated               
efghi examl from templated                        
Sample time from [templated]       

I want to extract the the values of last word as show below 

Source                                                                  Extract Value
Sample time from tx-templated               tx-templated
efghi examl from templated                        templated
Sample time from [templated]                   templated           

 

how to do via regex?

 

Thanks in advance for help

Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| rex "(?<lastword>[\w-]+)\W*?$"
0 Karma
Get Updates on the Splunk Community!

Customer Experience | Splunk 2024: New Onboarding Resources

In 2023, we were routinely reminded that the digital world is ever-evolving and susceptible to new ...

Celebrate CX Day with Splunk: Take our interactive quiz, join our LinkedIn Live ...

Today and every day, Splunk celebrates the importance of customer experience throughout our product, ...

How to Get Started with Splunk Data Management Pipeline Builders (Edge Processor & ...

If you want to gain full control over your growing data volumes, check out Splunk’s Data Management pipeline ...