All Apps and Add-ons

Search Command: Quantify: How to filter events with only last string last word of event

stagare
New Member
2019-08-26 20:21:18 10.1.82.42 GET /aaaa/bbbb/ccc/ddddd/eeeee username=test&branch=KEL&account=123456789 443 ABCD\HTTP/secure.abc.jss.pre 11.12.13.14 Java1.7.0_191 - 200 0 0 65018

I want only the last value 65018.
I am not able to achieve it with regex.

0 Karma

Sukisen1981
Champion
| makeresults 
|  eval x="2019-08-26 20:21:18 10.1.82.42 GET /aaaa/bbbb/ccc/ddddd/eeeee username=test&branch=KEL∾count=123456789 443 ABCD\HTTP/secure.abc.jss.pre 11.12.13.14 Java1.7.0_191 - 200 0 0 65018"
| rex field=x ".*\s+(?<lastfld>.*)"

replace 'x' by _raw

    | rex field=_raw ".*\s+(?<lastfld>.*)"
0 Karma

Sukisen1981
Champion

hi @stagare

Please accept the answer if it significantly helped resolve your issue or let us know if there are any more issues

0 Karma
Get Updates on the Splunk Community!

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...