topic Re: Parse out the last word in a string in DQL

Parse out the last word in a string

pieter_luttig — Tue, 18 Mar 2025 14:08:57 GMT

Does anyone know if it is possible to parse out the last word in a string? (The word can differ)

The DPL reference does not mention this anywhere.

Regards

Pieter

Re: Parse out the last word in a string

zaid-bashir — Wed, 19 Mar 2025 06:03:27 GMT

Hi @pieter_luttig
We can achieve this using plain DQL as well. Below is the DQL query for the same.

data record(name = "Hello Dynatrace Community") | fieldsAdd parsed = splitString(name," ") | fieldsAdd result = arrayLast(parsed)

The above query is dynamic, you can use this for any string text. The working is simple:

1) First take the string data which you have to parse.
2) Then Split the String using splitString function with some pattern like " " (SPACE) here. It will convert String in List.
3) Finally, use function arrayLast to get the last part of the string.

Re: Parse out the last word in a string

pieter_luttig — Wed, 19 Mar 2025 07:18:16 GMT

Hi @zaid-bashir,

Thanks for this, maybe let me give you an example of my data set.

With the below, I need to create an attribute to calculate the number of each currency pair (GBPZAR, USDZAR, etc.) which differs with every quote. The Currency pair is always the last word in the string.

2025-02-16T09:02:05.706761982+02:00 stdout F 2025-02-16 09:02:05,706 INFO 1dsd456a123-exxx1-4c345-923ws-0c5xxxxxxx4455555 FXRatesService.MoveNext - Get FX Rate Quote: TFX - Tier 3 - TH34fghJUy68Vfgjg12z67 - GBPZAR

Regards

Re: Parse out the last word in a string

PacoPorro — Wed, 19 Mar 2025 07:44:05 GMT

Could you please try with

fetch logs | fieldsAdd lastWord = arrayLast(splitString(content, " "))

May work

Re: Parse out the last word in a string

zaid-bashir — Wed, 19 Mar 2025 07:47:41 GMT

Thanks for the input @pieter_luttig
Do You Need In This Format

Here is a sample dataset I created for You With DQL Query.

data record(dset1 = "2025-02-16T09:02:05.706761982+02:00 stdout F 2025-02-16 09:02:05,706 INFO 1dsd456a123-exxx1-4c345-923ws-0c5xxxxxxx4455555 FXRatesService.MoveNext - Get FX Rate Quote: TFX - Tier 3 - TH34fghJUy68Vfgjg12z67 - GBPZAR"), record(dset1 = "2025-02-16T09:03:10.812345678+02:00 stdout F 2025-02-16 09:03:10,812 INFO 2asd789b456-zyyy2-5d678-456ab-1d5yyyyyyy6677777 FXRatesService.MoveNext - Get FX Rate Quote: TFX - Tier 3 - YU56dfgHJk90Xyzkl34z78 - USDJPY"), record(dset1 = "2025-02-16T09:04:15.923456789+02:00 stdout F 2025-02-16 09:04:15,923 INFO 3qwe012c789-abcd3-6e901-567cd-2e6zzzzzzz8899999 FXRatesService.MoveNext - Get FX Rate Quote: TFX - Tier 3 - OP78hjkLMn12Wxyzm56a89 - EURUSD"), record(dset1 = "2025-02-16T09:05:20.034567890+02:00 stdout F 2025-02-16 09:05:20,034 INFO 4rty345d012-wxyz4-7f234-678de-3f7aaaaaaa9900000 FXRatesService.MoveNext - Get FX Rate Quote: TFX - Tier 3 - ZX90mnoPQr34Abcde78b01 - AUDCAD"), record(dset1 = "2025-02-16T09:06:25.145678901+02:00 stdout F 2025-02-16 09:06:25,145 INFO 5uio678e345-lmno5-8g567-789ef-4g8bbbbbbb0111111 FXRatesService.MoveNext - Get FX Rate Quote: TFX - Tier 3 - CV12qrsTUv56Defgh90c23 - NZDCHF"), record(dset1 = "2025-02-16T09:07:30.256789012+02:00 stdout F 2025-02-16 09:07:30,256 INFO 6asd901f678-pqrs6-9h890-890fg-5h9ccccccc1222222 FXRatesService.MoveNext - Get FX Rate Quote: TFX - Tier 3 - BN34uvwXYz78Gijkl12d45 - USDCHF"), record(dset1 = "2025-02-16T09:08:35.367890123+02:00 stdout F 2025-02-16 09:08:35,367 INFO 7zxc234g901-qrst7-0i123-901gh-6i0ddddddd2333333 FXRatesService.MoveNext - Get FX Rate Quote: TFX - Tier 3 - KL56mnoPQr90Hijkl34e67 - GBPJPY"), record(dset1 = "2025-02-16T09:09:40.478901234+02:00 stdout F 2025-02-16 09:09:40,478 INFO 8vbn567h234-uvwx8-1j456-012hi-7j1eeeeeee3444444 FXRatesService.MoveNext - Get FX Rate Quote: TFX - Tier 3 - OP78hjkLMn12Xyzkl56f89 - EURJPY"), record(dset1 = "2025-02-16T09:10:45.589012345+02:00 stdout F 2025-02-16 09:10:45,589 INFO 9mkl890i567-wxyz9-2k789-123ij-8k2fffffff4555555 FXRatesService.MoveNext - Get FX Rate Quote: TFX - Tier 3 - ZX90mnoPQr34Abcde78g01 - CADJPY"), record(dset1 = "2025-02-16T09:11:50.690123456+02:00 stdout F 2025-02-16 09:11:50,690 INFO 10qwe123j890-abcd0-3l012-234jk-9l3ggggggg5666666 FXRatesService.MoveNext - Get FX Rate Quote: TFX - Tier 3 - CV12qrsTUv56Defgh90h23 - AUDJPY") | fieldsAdd parsed = splitString(dset1,"-") | fieldsAdd currency = arrayLast(parsed) | dedup currency | summarize currencyCount = count(), by:{dset1,currency}

Re: Parse out the last word in a string

pieter_luttig — Wed, 19 Mar 2025 07:52:03 GMT

Hi @PacoPorro , this is exactly what I am looking for, thank you!

Re: Parse out the last word in a string

pieter_luttig — Wed, 19 Mar 2025 07:53:43 GMT

Hi @zaid-bashir , this will also work for me, thanks for showing!

Regards

Re: Parse out the last word in a string

pieter_luttig — Wed, 19 Mar 2025 07:57:54 GMT

I have to ask, how do I keep the dataset up to date?

Re: Parse out the last word in a string

zaid-bashir — Wed, 19 Mar 2025 08:00:35 GMT

Thanks for acknowledging the solution.
I didn't understand, Can you explain it a bit.

Re: Parse out the last word in a string

pieter_luttig — Wed, 19 Mar 2025 08:07:13 GMT

Sure,

I need to create a log processing rule to structure the data in such a way as to create an attribute for the currency pairs. This way I can use the attribute in a metric dimension to split by each currency pair count.

Regards

Re: Parse out the last word in a string

pieter_luttig — Wed, 19 Mar 2025 08:29:57 GMT

@PacoPorro Do you know why this does not work with log processing rules? Does it use a different syntax?

Re: Parse out the last word in a string

zaid-bashir — Wed, 19 Mar 2025 08:30:06 GMT

Thanks for the input @pieter_luttig
I created a log processing rule and also a DPL way to extract currency. Have a look at Screenshots attached below.

And the DPL way to extract Currency is as following:

PARSE(content,"ld 'Tier' SPACE INT SPACE '-' SPACE ALNUM SPACE '-' SPACE string:value")

Now Whenever you fetch logs matching content "Get FX Rate", they will contain one field "value", where your currency will be stored.

Thanks for posting this question, I also learned a lot.

Re: Parse out the last word in a string

pieter_luttig — Wed, 19 Mar 2025 08:48:18 GMT

Hi @zaid-bashir , you nailed it, this is working perfectly!

I made the mistake of thinking that DQL and DPL have some degree of compatibility between them.

Apologies for not explaining it better from the beginning.

Regards

Pieter

Re: Parse out the last word in a string

zaid-bashir — Wed, 19 Mar 2025 09:46:24 GMT

Hi @pieter_luttig
Glad to hear that you are satisfied with the Solution.

Re: Parse out the last word in a string

zaid-bashir — Wed, 19 Mar 2025 09:51:36 GMT

Hi @pieter_luttig
For better understanding, go to the example link shown above...