```
Dec 27 01:47:46 pvlpfSense01 unbound: [91480:1] info: resolving acceptor.mcafee-mvision-mobile[.]com. A IN
|makeresults
| eval _raw="Dec 27 01:47:46 pvlpfSense01 unbound: [91480:1] info: resolving acceptor.mcafee-mvision-mobile.com. A IN
Dec 27 01:47:46 pvlpfSense01 unbound: [91480:0] info: resolving ns-1608.awsdns-09.co.uk. AAAA IN"
| multikv noheader=t
| table _raw
| rex "(?<time>\S+ \d\d \S+) (?<sensor>\S+) (?<bound>\S+): \[(?<session>\d+:\d+)\] info: resolving (?P<query>\S+)\s(?P<query_type>\S+)"
|makeresults
| eval _raw="Dec 27 01:47:46 pvlpfSense01 unbound: [91480:1] info: resolving acceptor.mcafee-mvision-mobile.com. A IN
Dec 27 01:47:46 pvlpfSense01 unbound: [91480:0] info: resolving ns-1608.awsdns-09.co.uk. AAAA IN"
| multikv noheader=t
| table _raw
| rex "(?<time>\S+ \d\d \S+) (?<sensor>\S+) (?<bound>\S+): \[(?<session>\d+:\d+)\] info: resolving (?P<query>\S+)\s(?P<query_type>\S+)"
Thats smart, I hadn't thought of using eval to feed in data with a search time extraction. Thanks for that piece.
So using this method to test it appears the match is correct. So the problem Im having is likely related to the App changes Ive done
|makeresults
| eval _raw="Dec 27 01:47:46 pvlpfSense01 unbound: [91480:1] info: resolving acceptor.mcafee-mvision-mobile.com. A IN
Dec 27 01:47:46 pvlpfSense01 unbound: [91480:0] info: resolving ns-1608.awsdns-09.co.uk. AAAA IN
Dec 27 16:00:51 pvlpfSense01 unbound: [15920:1] info: resolving (init part 3): 165.185.in-addr.arpa. DS IN"
| multikv noheader=t
| table _raw
| rex "(?<time>\S+ \d\d \S+) (?<sensor>\S+) (?<bound>\S+): \[(?<session>\d+:\d+)\] info: resolving (?:\(init part \d\):\s{2})?(?P<query>[\S?]+)\.\s(?P<query_type>\S+)"
The example you gave includes the final "." in the FQDN. I will mark your answer as correct since you gave me the piece I was missing to test the extraction in realtime.
Thanks!