{"id":78605,"date":"2023-10-17T14:00:56","date_gmt":"2023-10-17T14:00:56","guid":{"rendered":"https:\/\/merikebi.warrenmyers.com\/?p=78605"},"modified":"2023-10-17T14:00:56","modified_gmt":"2023-10-17T14:00:56","slug":"answer-by-warren-for-regex-extraction-from-right-to-left","status":"publish","type":"post","link":"https:\/\/merikebi.warrenmyers.com\/?p=78605","title":{"rendered":"Answer by warren for Regex extraction from Right to Left"},"content":{"rendered":"<p>You want a variable-list of field <em>names<\/em> extracted from delimited data in reverse order?<\/p>\n<p>How many entries could you <em>possibly<\/em> have? Three? Five? Two hundred seventy four?<\/p>\n<p>Are you trying to do this at search time (ie in SPL you are writing\/running), or in props.conf?<\/p>\n<p>If you are trying to do this at search time, I would not try to use a regular expression at all &#8211; use <a href=\"https:\/\/docs.splunk.com\/Documentation\/Splunk\/latest\/SearchReference\/MultivalueEvalFunctions#split.28.26lt.3Bstr.26gt.3B.2C.26lt.3Bdelim.26gt.3B.29\" rel=\"nofollow noreferrer\"><code>split()<\/code><\/a> (or <a href=\"https:\/\/docs.splunk.com\/Documentation\/Splunk\/latest\/SearchReference\/makemv\" rel=\"nofollow noreferrer\"><code>makemv<\/code><\/a>) and <a href=\"https:\/\/docs.splunk.com\/Documentation\/Splunk\/latest\/SearchReference\/MultivalueEvalFunctions#mvindex.28.26lt.3Bmv.26gt.3B.2C.26lt.3Bstart.26gt.3B.2C.26lt.3Bend.26gt.3B.29\" rel=\"nofollow noreferrer\"><code>mvindex()<\/code><\/a> (with negative indexing) to find the items you want:<\/p>\n<pre><code>...\n| eval mvlist=split(delimited_field,&quot;,&quot;)\n...\n| eval three=mvindex(mvlist,-3)\n...\n<\/code><\/pre>\n<p>from User warren &#8211; Stack Overflow https:\/\/stackoverflow.com\/questions\/77254032\/regex-extraction-from-right-to-left\/77309653#77309653<br \/>\nvia <a href=\"https:\/\/ifttt.com\/?ref=da&#038;site=wordpress\">IFTTT<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>You want a variable-list of field names extracted from delimited data in reverse order? How many entries could you possibly have? Three? Five? Two hundred seventy four? Are you trying to do this at search time (ie in SPL you are writing\/running), or in props.conf? If you are trying to do this at search time, &hellip;<br \/><a href=\"https:\/\/merikebi.warrenmyers.com\/?p=78605\" class=\"more-link pen_button pen_element_default pen_icon_arrow_double\">Continue reading <span class=\"screen-reader-text\">Answer by warren for Regex extraction from Right to Left<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[4],"tags":[991],"keyring_services":[],"class_list":["post-78605","post","type-post","status-publish","format-standard","hentry","category-blih","tag-stackexchange"],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/posts\/78605","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=78605"}],"version-history":[{"count":1,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/posts\/78605\/revisions"}],"predecessor-version":[{"id":78606,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/posts\/78605\/revisions\/78606"}],"wp:attachment":[{"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=78605"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=78605"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=78605"},{"taxonomy":"keyring_services","embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Fkeyring_services&post=78605"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}