How to clean up dnslogs and replacing and trimming characters?

[secphilomath1]

We have some MS dns logs we want to ingest and we want to clean up some of the text before processing.

Essentially the fielddata is coming in as (10)somedomain(3)diy(8)whatever(3)com(0) and we want to only show as somedomain.diy.whatever.com

I have the first part I think, and using the search as a test of course...

| rex field=query mode=sed "s/\(.*?\)/./g"

Which leaves me with .somedomain.diy.whatever.com. I can't seem to find a way to get rid of the leading and trailing .'s 

Is there away to do it in all one line?  Bear with me here, this is new territory for me.

Thanks for your help

[yeahnah]

Hi @secphilomath1 

Here's a method you could try

| makeresults
| eval query="(10)somedomain(3)diy(8)whatever(3)com(0)"
      ,query=replace(query, "^\(\d+\)|\(\d+\)$", "")
| rex field=query mode=sed "s/\(.*?\)/./g"

 Hope it helps