I have a regex question that I hope will be easy for someone. I’m not big on regexes so I’m coming to you all for help. I have events where the user account is coming in by itself (xyz123) and sometimes with the domain (domain\xyz123), see below. I was able to just pull out the user IDs with a regex, but it had two capture groups instead of just one [U|u]ser\s(?:[\w\.]+\\(\w+)|([\w]+))\s
. I’d like to have one capture group that only has the user ID.
[MsgID: 2]The user domain\xyz123 with source IP address
[MsgID: 2]The user xyz123 with source IP address
Try this:
[uU]ser\s(?:[\w.]+\\)?(?<user>\w+)\s
...provided I correctly understand your problem 🙂
Hi kmcconnel,
assuming your ID's are always 6 alphanumeric values and are always before with
in the events, try this regex:
(?<myUserID>\w{6})(?=\swith)
hope this helps ...
cheers, MuS
Try this:
[uU]ser\s(?:[\w.]+\\)?(?<user>\w+)\s
...provided I correctly understand your problem 🙂
I tried both approaches and they both work, but the answer from martin_mueller was what I had been working toward. Thank you both for the help.
This works fine after added additional backslash after [\w.]+
HeHe, too slow again....