https://community.splunk.com/t5/Splunk-Search/Regex-expression/m-p/97258#M25117 <P>Hi</P> <P>I have events like this and i am using the below expression to extract the command before query string.</P> <PRE><CODE>sourcetype="access_combined_wcookie" host=prlws* | rex field=uri "(?P&lt;command&gt;\w+)" | top limit=50 command </CODE></PRE> <P>But it is capturing gcom as it has . after gcom.suggestions.json. Is there way to capture the whole thing meaning gcom.suggestions.json</P> <PRE><CODE>167.234.83.253 - - [16/Jul/2013:17:47:44 -0500] "GET /gcom.suggestions.json?selectedText=5GKA2*&amp;start=0&amp;count=Infinity HTTP/1.1" 200 167.234.83.254 - - [16/Jul/2013:17:47:52 -0500] "GET /GenericController?action=getSecurityToken&amp;domain=new.grainger.com&amp;_=1374014869039 HTTP/1.1" 200 </CODE></PRE> Tue, 16 Jul 2013 22:57:51 GMT xvxt006 2013-07-16T22:57:51Z https://community.splunk.com/t5/Splunk-Search/Regex-expression/m-p/97258#M25117 <P>Hi</P> <P>I have events like this and i am using the below expression to extract the command before query string.</P> <PRE><CODE>sourcetype="access_combined_wcookie" host=prlws* | rex field=uri "(?P&lt;command&gt;\w+)" | top limit=50 command </CODE></PRE> <P>But it is capturing gcom as it has . after gcom.suggestions.json. Is there way to capture the whole thing meaning gcom.suggestions.json</P> <PRE><CODE>167.234.83.253 - - [16/Jul/2013:17:47:44 -0500] "GET /gcom.suggestions.json?selectedText=5GKA2*&amp;start=0&amp;count=Infinity HTTP/1.1" 200 167.234.83.254 - - [16/Jul/2013:17:47:52 -0500] "GET /GenericController?action=getSecurityToken&amp;domain=new.grainger.com&amp;_=1374014869039 HTTP/1.1" 200 </CODE></PRE> Tue, 16 Jul 2013 22:57:51 GMT https://community.splunk.com/t5/Splunk-Search/Regex-expression/m-p/97258#M25117 xvxt006 2013-07-16T22:57:51Z https://community.splunk.com/t5/Splunk-Search/Regex-expression/m-p/97259#M25118 <P>Hello</P> <P>Try with this regex:</P> <PRE><CODE>...| rex field=uri "(?P&lt; command &gt;(\w+|\.)+)" | ... </CODE></PRE> <P>*Remove blanks before and after command</P> <P>Regards</P> Wed, 17 Jul 2013 06:43:23 GMT https://community.splunk.com/t5/Splunk-Search/Regex-expression/m-p/97259#M25118 gfuente 2013-07-17T06:43:23Z https://community.splunk.com/t5/Splunk-Search/Regex-expression/m-p/97260#M25119 <P>Thank you. It worked !!!</P> Thu, 18 Jul 2013 15:17:05 GMT https://community.splunk.com/t5/Splunk-Search/Regex-expression/m-p/97260#M25119 xvxt006 2013-07-18T15:17:05Z