Regular expression is not working properly.. Please suggest

[rajim]

I need to have the first qualifier of a FQDN string. I have used the below mentioned query to do so. But it's not recognizing the ".". Could anyone please help me out here.

index=myindex_glbl 
| rex field=Domain "^(?<Territory>.*)\."
| dedup Domain
| table Domain Territory

Here is the sample output:

Domain  Territory
us.nam.ad.xyz.com   us.nam.ad.xyz
crb.nam.ad.xyz.com  crb.nam.ad.xyz

This is very strange behaviour. Can anybody suggest why this is happening?

[493669 · Accepted solution]

Try this regex:

| rex field=Domain "^(?<Territory>[^\.]+)"

below regex will check till it found last "." instead of first while above regex will find first "."

| rex field=Domain "^(?<Territory>.*)\."

[rajim]

Thanks .. It's working... so if the delimiter character is mentioned after the ")", then it'll search for last occurance, right?

[493669]

not only when it is mentioned after ")" if you try | rex field=Domain "^(?<Territory>.*\.)" then also it will search for last occurance.

[rajim]

got it .. thnks.