lastindexof()

The lastindexof() function returns the index of the last occurrence of a specified substring within a string.

Syntax

Parameters

STR

The string to search within.

NEEDLE

The substring to find within STR.

FROM_INDEX

The index position at which to start the backward search. Indices start at 0. When specified, the search proceeds backward from that position toward index 0. A negative value is treated as 0.

Description

The lastindexof() function returns the index (32-bit integer) of the last occurrence of NEEDLE within STR. If NEEDLE is not found, the function returns -1.

If FROM_INDEX is specified, the search proceeds backward from that position. The function returns the last position where the starting index of NEEDLE is between 0 and FROM_INDEX (inclusive).

If STR or NEEDLE is null, the function returns null. Non-string values are converted using toString() before processing.

Error codes

N/A

Usage examples

To prepare the WEB_APACHE_SAMPLE table used in these examples, refer to Preparing sample data.

1. Find the last / in a URI

   table limit=5 WEB_APACHE_SAMPLE | eval result = lastindexof(uri, "/") | fields uri, result
   | # result: the index of the last slash
   

2. Extract the filename after the last / in a URI

   table limit=5 WEB_APACHE_SAMPLE
   | eval pos = lastindexof(uri, "/")
   | eval filename = substr(uri, pos + 1)
   | fields uri, filename
   

3. Search for a substring that is not present

   table limit=5 WEB_APACHE_SAMPLE | eval result = lastindexof(method, "?") | fields method, result
   | # result: -1
   

4. Specify a starting position for the search (FROM_INDEX)

   table limit=5 WEB_APACHE_SAMPLE | eval result = lastindexof(uri, "/", 5) | fields uri, result
   

5. NULL input

   json "{'val': null}" | eval result = lastindexof(val, "/")
   | # result: null
   

Compatibility

The lastindexof() function is available since version 4.0.2312.0.