You want a variable-list of field names extracted from delimited data in reverse order?
How many entries could you possibly have? Three? Five? Two hundred seventy four?
Are you trying to do this at search time (ie in SPL you are writing/running), or in props.conf?
If you are trying to do this at search time, I would not try to use a regular expression at all – use split() (or makemv) and mvindex() (with negative indexing) to find the items you want:
...
| eval mvlist=split(delimited_field,",")
...
| eval three=mvindex(mvlist,-3)
...
from User warren – Stack Overflow https://stackoverflow.com/questions/77254032/regex-extraction-from-right-to-left/77309653#77309653
via IFTTT