Regex help!!!

[splunker9999]

Hi,

Can someone please help with formatting IP address or FQDN,we nee to remove [ ] in the below.

These below details are available in field name "Indicator_Value"

221[.]138[.]128[.]116
www[.]cderlearn[.]com

Thanks

[gokadroid]

Try this using mode=sed

your query to return events
| rex field=Indicator_Value mode=sed "s/\[//g
s/\]//g"

Please ensure to keep the string "s/\[//g and s/\]//g" split over two lines exactly how it appears in the query. Take care of the " (double quotes) to be same as it appears in the query.

[twinspop]

... | eval newfield=replace(Indicator_Value,"[\[\]]","")