What does the "\1/" do in the regex of this Splunk search?

[Madhan45]

index=xxx sourcetype=yyy CSI_ID="1234"| rex field=COMPONENT_ID mode=sed "s/(.*)(\..*){4}/\1/"| table COMPONENT_ID

In this search, what does \1/ do?

[somesoni2]

In this search

index=xxx sourcetype=yyy CSI_ID="1234"| rex field=COMPONENT_ID mode=sed "s/(.*)(\..*){4}/\1/"| table COMPONENT_ID

There are 3 portion of the rex command regular expression

1. s/ :- this denotes that its a string replacement. (y will be used for character replacement)
2. (.*)(\..)){4}/ :- this identifies two part of in the values of field COMPONENT_ID, 2nd part is the extension starting with dot and 3 more character, 1st part is everything else before that. [so if COMPONENT_ID="D:\foo\bar\tbd.log", then first part is "D:\foo\bar\tbd" and 2nd part is ".log"]
3. \1/ :- this part specifies which part will be retained from the parts identified by expression mentioned in 2nd point. So \1 means only the first part (without extension) will be retained. Last slash is to end the replacement section.

So if you run the following

| gentimes start=-1 | eval COMPONENT_ID="D:\foo\bar\tbd.log" | rex field=COMPONENT_ID mode=sed "s/(.*)(\..*){4}/\1/"| table COMPONENT_ID

The output will be "D:\foo\bar\tbd"

[ramdaspr]

\1 is for backreference