Splunk Search
Highlighted

help with regex

Builder

How to capture everything until second period.I have the below sample data.I want to capture the one in bold

YYMPv2-SOI::curators."9.9.42.1.3.2.1.8.2059119261.2164944.1.1" = "0x0aa0a04b"

YYMPv2-SOI::curatorss."9.9.42.1.3.1.1.11.453195837.1804944.1.1.1" = "31"

Thanks in advance

Highlighted

Re: help with regex

Explorer

Something like this will work with your dataset:

(\d{5,}.\d{5,}.\d+\.\d+)

View solution in original post

0 Karma
Highlighted

Re: help with regex

Builder

Thank you much

0 Karma
Highlighted

Re: help with regex

Builder

Here is one way to do it:

(your search)
| rex ".*?(\d+\.){8}(?<captured>((\d+\.){3}\d))"

See https://regex101.com/r/y09W84/1

0 Karma
Highlighted

Re: help with regex

Builder

@jpolvino Thank You.this worked but I can accept only one answer

0 Karma