How to use regex to get only the data cd?

[shreyasamin64]

Regex to get only the data cd

ab.aaaa.asd.cd

[venky1544]

HI @shreyasamin64 

you can try the below regex

| makeresults |eval new = "ab.aaaa.asd.cd" |rex field=new "(?<final>[\w+.].$)"|table _time,new ,final

if it helps karma points are appreciated/please accept the solution if it worked 

[ITWhisperer]

| rex "(\w+\.){3}(?<cd>\w+)"