Splunk Search

Extract Last 12 Characters

IRHM73
Motivator

Hi, I wonder whether someone could help me please.

I have the following string, which I'm trying to extract the last 12 characters i.e. A1B-CDEFB-NOT

claim-a-token|N5Y-UWLB-NOT

I've tried using the following regex /|(?[^\s]+) but unfortunately it extracts the whole string and not just the last 12 characters, and I'm a little unclear why.

Could someone perhaps look at this please and offer some guidance on where I've gone wrong.

Many thanks

Chris

Tags (3)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi IRHM73,
if you haven't spaces in your string, this is your regex:

(?<field>[^ ]{12})$

if instead you have spaces in your string, you could use this regex:

(?<field>.{12})$

Bye.
Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi IRHM73,
if you haven't spaces in your string, this is your regex:

(?<field>[^ ]{12})$

if instead you have spaces in your string, you could use this regex:

(?<field>.{12})$

Bye.
Giuseppe

IRHM73
Motivator

Hi @cusello, thank you very much for this, it works great.

Many thanks and kind regards

Chris

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...