- There are two lines of info in a column but it appears that there's no whitespace or whatsoever in between those lines. I would only want to extract the bottom line and output the result into a new column called 'Target' but the rex command that I have just refused to pull that info on the second line. I have tested the command in the Regex online simulator and it works but in the real Splunk environment, it doesn't seem to be able to extract it.
| rex field=Account_Name "\n.+(?)$"
- I would like to extract the server name (HOEFCE30A) from the _raw column but if I use rex, there's no unique value to identify where Splunk should start to pull that info since the beginning part of the column is date and time which changes every time.
| rex "xxx=(?<"Server">.+) CEF"
Any help would be greatly appreciated. Thank you very much! 🙂
