How to extract the host name and database name

[dkannanjanakan]

Hi, I would like to extract the Host Name and Database Name from the below string.

URL : jdbc:sqlserver://WBMSSQLOPSD1:5800_databaseName=OPSActivities_dev

search

| rex field=Host "(sqlserver:..\s?(?<HostName>[^:]+))" 

Above regex extracts the Host name, I would like to extract database name as well. Please help.

Expected output WBMSSQLOPSD1:OPSActivities_dev

Thanks,
Dhana

[cpetterborg]

What about:

|  makeresults 
|  eval Host="URL : jdbc:sqlserver://WBMSSQLOPSD1:5800_databaseName=OPSActivities_dev"
|  rex field=Host "//(?P<server>[^:]+):[^=]*=(?P<DB>.*)"

and to combine them:

|  makeresults 
|  eval Host="URL : jdbc:sqlserver://WBMSSQLOPSD1:5800_databaseName=OPSActivities_dev"
|  rex field=Host "//(?P<server>[^:]+):[^=]*=(?P<DB>.*)"
| eval expected=server.":".DB