Regex expression

[hashsplunk]

prd-sso-data-science-711-3006-compute-role

dev-1000-535-aibench-mlops-service-compute-role

above are the field values . I need to extract the code 711-3006 & 1000-535

I have given the regular expression  |rex field="Role" ".*(?<Projectcode>\d{3,4}-\d+)" but its not fetching the code properly . It give 000-535 in the second value. Kindly help

[manjunathmeti]

Try this:

| rex field=Role "\w+-(?<Projectcode>\d{3,4}-\d+)-\w+"

If this reply helps you, an upvote/like would be appreciated.