Combining Splunk ITSI regular expression SPL?

[AnushaJone]

I need help to combine line 1 and 2 make it as one regular expression line in SPL query 

1.      | rex "(?<object>gov\.usda\.fsa\.[^\s]+)"
2.      | eval object=split(coalesce(object, "NA"),"."),object=mvindex(object,-1)

Please help!

[yeahnah]

Hi @AnushaJone 

You've not provided any example the raw event and the expected outcome of the rex.  So, assuming you are looking for the top-level domain each time, then here is a run anywhere example of what to do...

| makeresults
| eval _raw="gov.usda.fsa.blah"
| rex "(?<object>gov\.usda\.fsa\.[^\s]+)"
| eval object=split(coalesce(object, "NA"),"."), object=mvindex(object,-1)
| rex "gov\.usda\.fsa\.(?<object2>[^\s]+)"

So the last rex line gives the same result and the rex and eval above.  However, maybe you're looking for something more generic ¯\_(ツ)_/¯

Hope it helps