How to use regex to get only the data cd? - Splunk Community

Knowledge Management

Regex to get only the data cd

ab.aaaa.asd.cd

HI @shreyasamin64

you can try the below regex

| makeresults |eval new = "ab.aaaa.asd.cd" |rex field=new "(?<final>[\w+.].$)"|table _time,new ,final

if it helps karma points are appreciated/please accept the solution if it worked

| rex "(\w+\.){3}(?<cd>\w+)"

Get Updates on the Splunk Community!

Infographic provides the TL;DR for the 2023 Splunk Career Impact Report

We’ve been shouting it from the rooftops! The findings from the 2023 Splunk Career Impact Report showing that ...

Splunk Lantern | Getting Started with Edge Processor, Machine Learning Toolkit ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...