Rex field to extract dot net module

[totaro]

Hi i currently have the following line in my search that search for system.net.webclient:

|rex max_match=0 "(?<module>(system.net.webclient))"

May i know how do i amend this to search for any syntax that match system.xxx.xxx so it work for all the module?

[richgalloway]

Try |rex max_match=0 "(?<module>system\.[^\.]+\.\S+)".

[totaro]

This actually works better if the data was more organize; sadly my data was not and it capture too many noise

[vnravikumar · Accepted solution]

Hi

check this

| makeresults 
| eval test= "system.com.testclient" 
| rex field=test max_match=0 "(?<module>(system\.\w+\.\w+))"