title: Need to extract and re-format with RegEx
body: <p>I'm using Splunk to parse some logs that have our "hub" and "comp" IDs embedded in them, down in the body of the message. I need to use a field extraction RegEx to pull them out in the form: HHHH-CCCC where the data appears like this: </p>
  
  <pre><code>Hub:[HHHH] Comp: [HHHH]
  </code></pre>
  
  <p>Here's an example record:</p>
  
  <blockquote>
    <p>RecordID:[00UJ9ANUHO5551212] TrackingID:[1234ANUHO5551212] Hub:[0472] Comp:[N259] Some event occurred, the log is in here::[\server\share\0472\N258\blah\blah\blah\somefile.txt], No exceptions raised.</p>
  </blockquote>
  
  <p>From that, I'd like to return:</p>
  
  <pre><code>0472-N259
  </code></pre>
  
  <p>I'm trying to learn (re-learn!  I learned this stuff 30 years ago!) capturing groups, and came up with this: </p>
  
  <pre><code>(?&lt;=Hub:\[)([A-Z0-9]{4})
  </code></pre>
  
  <p>From that I can get the 4 characters for the hub, but it won't let me do:</p>
  
  <pre><code>(?&lt;=Hub:\[)([A-Z0-9]{4})  (?&lt;=Comp:\[)([A-Z0-9]{4})
  </code></pre>
  
  <p>I'm kind of close, but am getting frustrated and it's time to go home, so I thought maybe SO could help me out overnight.  100 bounty for the best answer (please explain the solution).   I promise to come back and award when this question is eligible.  Answer doesn't have to be in splunk form (with <code>&lt;fieldname&gt;</code>) but that's helpful too.</p>
  
  <p>It's helpful if the RegEx can be pasted into <a href="http://gskinner.com/RegExr/">http://gskinner.com/RegExr/</a> so I can experiment further.</p>