Splunk Search

How to extract two characters before last set of numbers in a string?

jenkinsta
Path Finder

Tried many variations but just cant get it right. 

Example Data:
onetwoap321.site
onethreap3ua.somesite
oneforpd210.site
one3ninaw1u.site

The string may or may not have characters after the last set of numbers. There may be another number but will be seperated by at least 2 letters before the last set of numbers. 

{string}{number optional}{2 letters}{number}{optional characters}{may or may not have . at end}

The two letters is what I want to capture in a field called Code. 

| rex field=Name "^(?<Code>[^.]+)"

Thanks for any help. 

 

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| rex field=Name ".*(?<Code>[a-zA-Z]{2})\d"

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| rex field=Name ".*(?<Code>[a-zA-Z]{2})\d"
0 Karma

jenkinsta
Path Finder

I was so close at one point but didnt have the trailing \d. Thanks so much

0 Karma
Get Updates on the Splunk Community!

Splunk MCP & Agentic AI: Machine Data Without Limits

  Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization ...

Finding Based Detections General Availability

Overview  We’ve come a long way, folks, but here in Enterprise Security 8.4 I’m happy to announce Finding ...

Get Your Hands Dirty (and Your Shoes Comfy): The Splunk Experience

Hands-On Learning and Technical Seminars  Sometimes, you just need to see the code. For those looking for a ...