Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

how to extract latest occurrence of a field from multiple lines

$
0
0
Want to capture the latest occurrence of "working_condition_check - status -" which is "Stopped". Please help me in getting the regex. Below is the log message. 10/01/2018 15:01:04 Server_Name working_condition_check - status - Started working_condition_check - status - Running working_condition_check - status - Stopped

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>