Splunk Search

How to extract two characters before last set of numbers in a string?

jenkinsta
Path Finder

Tried many variations but just cant get it right. 

Example Data:
onetwoap321.site
onethreap3ua.somesite
oneforpd210.site
one3ninaw1u.site

The string may or may not have characters after the last set of numbers. There may be another number but will be seperated by at least 2 letters before the last set of numbers. 

{string}{number optional}{2 letters}{number}{optional characters}{may or may not have . at end}

The two letters is what I want to capture in a field called Code. 

| rex field=Name "^(?<Code>[^.]+)"

Thanks for any help. 

 

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| rex field=Name ".*(?<Code>[a-zA-Z]{2})\d"

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| rex field=Name ".*(?<Code>[a-zA-Z]{2})\d"
0 Karma

jenkinsta
Path Finder

I was so close at one point but didnt have the trailing \d. Thanks so much

0 Karma
Get Updates on the Splunk Community!

Get Schooled with Splunk Education: Explore Our Latest Courses

At Splunk Education, we’re dedicated to providing incredible learning experiences that cater to every skill ...

Splunk AI Assistant for SPL | Key Use Cases to Unlock the Power of SPL

Splunk AI Assistant for SPL | Key Use Cases to Unlock the Power of SPL  The Splunk AI Assistant for SPL ...

Buttercup Games: Further Dashboarding Techniques (Part 5)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...