title: Regular Expression works for all but 1.00 in Splunk rex
body: <p>I am use a rex in splunk to extract the decimal amount from a field that contains the amount plus the 3-digit currency code. Both values are separated by a space.</p>
  
  <p>Examples:</p>
  
  <pre><code>200.00 INR
  2390.11 INR
  1.00 INR
  1789.00 INR
  </code></pre>
  
  <p>I am using the rex command inline:</p>
  
  <pre><code>rex field=TxnAmt "(?&lt;TxnAmt&gt;[^\s]\d+.\d+)
  </code></pre>
  
  <p>Using this command is mostly successful, but where my error comes into play is with the 1.00 INR.</p>
  
  <p>Results:</p>
  
  <pre><code>200.00
  2390.11
  1.00 INR
  1789.00
  </code></pre>
  
  <p>Any ideas would be helpful. Full Disclaimer: I am not a full programmer, nor do I aspire to be, but I do enjoy writing Regexs on Splunk.</p>