Hey guys,
I'm having trouble finding a Regex to remove begining and ending from a domain match against my dns logs. For example I have the field extraction SOA\s(?
I can't figure out how to get rid of the outer periods.
Wild guess (without a sample)
SOAs\.(?<domain>[\w\.\d-]+)\.
Please share some sample events.