Splunk Search

REGEX Help to extract USERID

kmccowen
Path Finder

I'm trying to extract the userid field but am not able to get a clean extraction. I've tried several combinations all have different issues and are not exact.

FAILED REGEX Attempts:
^(?:[^[\n][){8}(?P[^]]+)
^(?:[^:\n]
:){7}\s+(?P\w+)
^[^)\n]*)']\s+[\w+:\s+(?P\w+)

data sub set:
[2016-05-03T23:59:57.225-05:00] [gw_server1] [NOTIFICATION] [] [com.charter.care.customer.view.device.backing.deviceStatusFlow.DeviceStatusManager] [tid: [ACTIVE].ExecuteThread: '26' for queue: 'weblogic.kernel.Default (self-tuning)'] [userId: nhorsley] [ecid: a44b71a4-e0b3-420d-9d59-fd890c508729-0024359c,0] [APP: chtrgwy] DM-provisioning-operation = REPROVISION_PHONE_INTERNET Account = 8357190022950*** Mac = 001dd6725*** AuditUser = CHTRGWY:nhorsley Status = INFO: QTS retry number 2 for order ID 50487161 - Location-JobCode-JobTitle - CC-Louisville Call Center-D713-Cust Rel Coord-Internet/Phone
VALID
[2016-05-03T23:59:56.390-05:00] [gw_server1] [NOTIFICATION] [] [com.charter.care.customer.memo.model.dao.MemoServiceHelper] [tid: [ACTIVE].ExecuteThread: '28' for queue: 'weblogic.kernel.Default (self-tuning)'] [userId: sshimin] [ecid: a44b71a4-e0b3-420d-9d59-fd890c508729-00243595,0] [APP: chtrgwy] 2016-05-03 23:59:56.39 - ADD MEMO PROCESSED - 8345780100010*** - UI0 - Caller verified - CC-Louisville Call Center-D719-Cust Rel Coord-Comm Repair
VALID
[2016-05-03T23:59:56.357-05:00] [gw_server3] [NOTIFICATION] [] [com.charter.customer.care.view.backing.banner.BannerFlowManager] [tid: [ACTIVE].ExecuteThread: '27' for queue: 'weblogic.kernel.Default (self-tuning)'] [userId: bxburns] [ecid: 1ca25884-aa12-4021-a3c7-b7865adbba6f-002474e8,0] [APP: chtrgwy] 2016-05-03 23:59:56.357 - TROUBLESHOOTING2 TAB CLICK - 8351200211445*** - HIR - CC-Louisville Call Center-D713-Cust Rel Coord-Internet/Phone
VALID
[2016-05-03T23:59:56.193-05:00] [gw_server1] [NOTIFICATION] [] [com.charter.care.customer.memo.model.dao.MemoServiceHelper] [tid: [ACTIVE].ExecuteThread: '28' for queue: 'weblogic.kernel.Default (self-tuning)'] [userId: sshimin] [ecid: a44b71a4-e0b3-420d-9d59-fd890c508729-00243595,0] [APP: chtrgwy] 2016-05-03 23:59:56.193 - ADD MEMO INITIATED - 8345780100010*** - UI0 - Caller verified - CC-Louisville Call Center-D719-Cust Rel Coord-Comm Repair
VALID
[2016-05-03T23:59:56.193-05:00] [gw_server1] [NOTIFICATION] [] [com.charter.customer.care.view.backing.banner.BannerFlowManager] [tid: [ACTIVE].ExecuteThread: '28' for queue: 'weblogic.kernel.Default (self-tuning)'] [userId: sshimin] [ecid: a44b71a4-e0b3-420d-9d59-fd890c508729-00243595,0] [APP: chtrgwy] 2016-05-03 23:59:56.193 - ACCOUNT VERIFIED - 8345780100010*** - UI0 - CC-Louisville Call Center-D719-Cust Rel Coord-Comm Repair

Tags (2)
0 Karma
1 Solution

ra01
Path Finder

a site like http://regexr.com/ is great to test out the extraction

userId:\s(?P<userid>\w+)\]

View solution in original post

kmccowen
Path Finder

Thanks everybody!

ra01
Path Finder

a site like http://regexr.com/ is great to test out the extraction

userId:\s(?P<userid>\w+)\]

jkat54
SplunkTrust
SplunkTrust

i show ra01 regexr today and then he uses it to one up me on an answer 😜

I argue my regex is more efficient though !!!

0 Karma

ra01
Path Finder

I have a section about using regexr in my work wiki I wrote on Splunk. 😉

I'm sure there's more efficient ways to write the expression.

0 Karma

jkat54
SplunkTrust
SplunkTrust

Yep, i confused you with someone else I worked with today. My apologies. Great site though!

ctaf
Contributor

Hello,

How about:

"\[userId:\s(?<userID>[^\]]+)"

I tried with this, and it worked:

|stats count | eval test="[com.charter.care.customer.view.device.backing.deviceStatusFlow.DeviceStatusManager] [tid: [ACTIVE].ExecuteThread: '26' for queue: 'weblogic.kernel.Default (self-tuning)'] [userId: nhorsley] [ecid: a44b71a4-e0b3-420d-9d59-fd890c508729-0024359c,0] [APP: chtrgwy] DM-provisioning-operation = REPROVISION_PHONE_INTERNET Account = 8357190022950* Mac = 001dd6725 AuditUser = CHTRGWY:nhorsley Status = INFO: QTS retry number 2 for order ID 50487161 - Location-JobCode-JobTitle - CC-Louisville Call Center-D713-Cust Rel Coord-Internet/Phone" | rex field=test "\[userId:\s(?<userID>[^\]]+)"

horsefez
Motivator

This is a good way of testing regular expressions. Thanks!

0 Karma

jkat54
SplunkTrust
SplunkTrust

Hi & good morning,

Let us know if this works:

userId:\s(?<userId>\w+)
0 Karma
Get Updates on the Splunk Community!

Index This | Forward, I’m heavy; backward, I’m not. What am I?

April 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

A Guide To Cloud Migration Success

As enterprises’ rapid expansion to the cloud continues, IT leaders are continuously looking for ways to focus ...

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...