Rex Command with multiple formatting options

[Dude]

Trying to get the rex command to extract the last name when the user field has multiple formatting outputs below. Is there a way to incorporate both options into a rex command?

| rex field=user "(?<user_last_name>[A-Za-z]+),.*" 

Smith, Bob

bob.t.smith.abc

[richgalloway]

This regex fits the two examples, but there are many other ways to represent names.

| rex field=user "(?J)(?<user_last_name>[A-Za-z]+),.*|[^\.]+\.[^\.]+\.(?<user_last_name>\w+)"

[Dude]

Each one of the halves work independently or if I create another name group they both work, but for whatever reason the (?J) modifier is not working. Also for the thread I did not know these regex modifiers existed.  Regex Modifiers 

[richgalloway · Accepted solution]

I forgot Splunk doesn't support (?J).  Sorry about that.  Try this, instead.  It extracts separate last name fields and then chooses the one that is not null.

| rex field=user "(?J)(?<last_name1>[A-Za-z]+),.*|[^\.]+\.[^\.]+\.(?<last_name2>\w+)"
| eval user_last_name=coalesce(last_name1, last_name2)