I am working with an email application. Currently doing a report based on domains using the product. Issue is there are many, and often arbitrary sub-domains. This is what I'm currently using: rex field=Sender ".[^@]+?@(?<sender_domain>.+)" The results from that look like: test.com sub.test.com why.so.many.subs.echo.com a.echo.com So what is the "right" way to get the last 2 fields on either side of the last DOT in the field? This is close but it only matches IF there is a subdomain and many are just TLD: rex field=Sender ".[^@]+?@.*(?<sender_domain>\.\w+\.[a-zA-Z]+$)" Thanks! ... View more