Regex Editor & Tester

Matches lines containing at least three semicolon-delimited fields, skipping past the third semicolon and any following whitespace, then captures the remainder of the line into a named group 'command'. Anchored to the start of the line and restricted from crossing newlines, it reliably extracts the fourth field. Typically used to pull the executed command out of sudo/audit log entries formatted with semicolon separators.