How to extract domain and top level domain?

[moayadalghamdi]

Dears

 I need your help in extracting the domain and top level domain from dns queries where:

Query Field                  |         extracted field

Account.fb.com         .         Fb.com

Aa.bb.cc.com              .         Cc.com

Www.google.com      .        Google.com

Thanks in advance 

[ITWhisperer]

| eval extractedField=mvjoin(mvindex(split(queryField,"."),-2,2),".")

[ITWhisperer · Accepted solution]

| rex field=queryField ".*\.(?<extractedField>\w+\.\w+)"