Parse out the last word in a string

[pieter_luttig]

Does anyone know if it is possible to parse out the last word in a string? (The word can differ)

The DPL reference does not mention this anywhere.

Regards

Pieter

[zaid-bashir]

Hi @pieter_luttig 
We can achieve this using plain DQL as well. Below is the DQL query for the same.

data record(name = "Hello Dynatrace Community")
| fieldsAdd parsed = splitString(name," ")
| fieldsAdd result = arrayLast(parsed)

The above query is dynamic, you can use this for any string text. The working is simple:

1) First take the string data which you have to parse.
2) Then Split the String using splitString function with some pattern like " " (SPACE) here. It will convert String in List.
3) Finally, use function arrayLast to get the last part of the string.

[pieter_luttig]

Hi @zaid-bashir,

Thanks for this, maybe let me give you an example of my data set. 

With the below, I need to create an attribute to calculate the number of each currency pair (GBPZAR, USDZAR, etc.) which differs with every quote. The Currency pair is always the last word in the string. 

2025-02-16T09:02:05.706761982+02:00 stdout F 2025-02-16 09:02:05,706 INFO  1dsd456a123-exxx1-4c345-923ws-0c5xxxxxxx4455555  FXRatesService.MoveNext - Get FX Rate Quote: TFX - Tier 3 - TH34fghJUy68Vfgjg12z67 - GBPZAR

2025-02-16T09:02:05.706761982+02:00 stdout F 2025-02-16 09:02:05,706 INFO  1dsd456a123-exxx1-4c345-923ws-0c5xxxxxxx4455555  FXRatesService.MoveNext - Get FX Rate Quote: Treasury One (Pty) Ltd - Tier 1 - 1 - USDZAR

Regards

[PacoPorro · Accepted solution]

Could you please try with

fetch logs
| fieldsAdd lastWord = arrayLast(splitString(content, " "))

May work

[pieter_luttig · Accepted solution]

Hi @PacoPorro , this is exactly what I am looking for, thank you!

[pieter_luttig]

@PacoPorro Do you know why this does not work with log processing rules? Does it use a different syntax? 

[zaid-bashir]

Hi @pieter_luttig 
For better understanding, go to the example link shown above...

[zaid-bashir]

Thanks for the input @pieter_luttig 
Do You Need In This Format

Here is a sample dataset I created for You With DQL Query.

data record(dset1 = "2025-02-16T09:02:05.706761982+02:00 stdout F 2025-02-16 09:02:05,706 INFO  1dsd456a123-exxx1-4c345-923ws-0c5xxxxxxx4455555  FXRatesService.MoveNext - Get FX Rate Quote: TFX - Tier 3 - TH34fghJUy68Vfgjg12z67 - GBPZAR"),
     record(dset1 = "2025-02-16T09:03:10.812345678+02:00 stdout F 2025-02-16 09:03:10,812 INFO  2asd789b456-zyyy2-5d678-456ab-1d5yyyyyyy6677777  FXRatesService.MoveNext - Get FX Rate Quote: TFX - Tier 3 - YU56dfgHJk90Xyzkl34z78 - USDJPY"),
     record(dset1 = "2025-02-16T09:04:15.923456789+02:00 stdout F 2025-02-16 09:04:15,923 INFO  3qwe012c789-abcd3-6e901-567cd-2e6zzzzzzz8899999  FXRatesService.MoveNext - Get FX Rate Quote: TFX - Tier 3 - OP78hjkLMn12Wxyzm56a89 - EURUSD"),
     record(dset1 = "2025-02-16T09:05:20.034567890+02:00 stdout F 2025-02-16 09:05:20,034 INFO  4rty345d012-wxyz4-7f234-678de-3f7aaaaaaa9900000  FXRatesService.MoveNext - Get FX Rate Quote: TFX - Tier 3 - ZX90mnoPQr34Abcde78b01 - AUDCAD"),
     record(dset1 = "2025-02-16T09:06:25.145678901+02:00 stdout F 2025-02-16 09:06:25,145 INFO  5uio678e345-lmno5-8g567-789ef-4g8bbbbbbb0111111  FXRatesService.MoveNext - Get FX Rate Quote: TFX - Tier 3 - CV12qrsTUv56Defgh90c23 - NZDCHF"),
     record(dset1 = "2025-02-16T09:07:30.256789012+02:00 stdout F 2025-02-16 09:07:30,256 INFO  6asd901f678-pqrs6-9h890-890fg-5h9ccccccc1222222  FXRatesService.MoveNext - Get FX Rate Quote: TFX - Tier 3 - BN34uvwXYz78Gijkl12d45 - USDCHF"),
     record(dset1 = "2025-02-16T09:08:35.367890123+02:00 stdout F 2025-02-16 09:08:35,367 INFO  7zxc234g901-qrst7-0i123-901gh-6i0ddddddd2333333  FXRatesService.MoveNext - Get FX Rate Quote: TFX - Tier 3 - KL56mnoPQr90Hijkl34e67 - GBPJPY"),
     record(dset1 = "2025-02-16T09:09:40.478901234+02:00 stdout F 2025-02-16 09:09:40,478 INFO  8vbn567h234-uvwx8-1j456-012hi-7j1eeeeeee3444444  FXRatesService.MoveNext - Get FX Rate Quote: TFX - Tier 3 - OP78hjkLMn12Xyzkl56f89 - EURJPY"),
     record(dset1 = "2025-02-16T09:10:45.589012345+02:00 stdout F 2025-02-16 09:10:45,589 INFO  9mkl890i567-wxyz9-2k789-123ij-8k2fffffff4555555  FXRatesService.MoveNext - Get FX Rate Quote: TFX - Tier 3 - ZX90mnoPQr34Abcde78g01 - CADJPY"),
     record(dset1 = "2025-02-16T09:11:50.690123456+02:00 stdout F 2025-02-16 09:11:50,690 INFO  10qwe123j890-abcd0-3l012-234jk-9l3ggggggg5666666  FXRatesService.MoveNext - Get FX Rate Quote: TFX - Tier 3 - CV12qrsTUv56Defgh90h23 - AUDJPY")

     | fieldsAdd parsed = splitString(dset1,"-")
     | fieldsAdd currency = arrayLast(parsed)
     | dedup currency
     | summarize currencyCount = count(), by:{dset1,currency}

[pieter_luttig]

Hi @zaid-bashir , this will also work for me, thanks for showing!

Regards

[pieter_luttig]

I have to ask, how do I keep the dataset up to date?

[zaid-bashir]

Thanks for acknowledging the solution.
I didn't understand, Can you explain it a bit. 

[pieter_luttig]

Sure,

I need to create a log processing rule to structure the data in such a way as to create an attribute for the currency pairs. This way I can use the attribute in a metric dimension to split by each currency pair count.

Regards

[zaid-bashir · Accepted solution]

Thanks for the input @pieter_luttig 
I created a log processing rule and also a DPL way to extract currency. Have a look at Screenshots attached below.

And the DPL way to extract Currency is as following:

PARSE(content,"ld 'Tier' SPACE INT SPACE '-' SPACE ALNUM SPACE '-' SPACE string:value")

Now Whenever you fetch logs matching content "Get FX Rate", they will contain one field "value", where your currency will be stored.

Thanks for posting this question, I also learned a lot.

[pieter_luttig]

Hi @zaid-bashir , you nailed it, this is working perfectly! 

I made the mistake of thinking that DQL and DPL have some degree of compatibility between them.

Apologies for not explaining it better from the beginning. 

Regards

Pieter

[zaid-bashir]

Hi @pieter_luttig 
Glad to hear that you are satisfied with the Solution.