If my rex field has one or multiple fields delimited by commas, how can I get the last value if there is more than one? Or if there is only one value, then retrieve that one.
Search: sourcetype="xxxxxx" | rex field=_raw "True IP:(?<true_ip>.*)"
True IP:220.127.116.11, 18.104.22.168 True IP:22.214.171.124
asked 07 Feb '12, 12:02
Thank you Kristian, you did give me the idea to resolve the issue correctly. It appears that what I needed was the first IP address and not the last.
I discovered erex and what a powerful tool! It generated the following rex that solved my problem:
If you are not interested in the first of two TrueIP's, you could always do something like this for a log message that looks like:
the field extraction would be something like:
hope this helps, but please provide more info in order to get better help
answered 07 Feb '12, 12:49