Splunk Search

rex extraction

a212830
Champion

Hi,

I'm trying to extract a field via rex for a search and having problems. Hoping someone could help me...

Here's some sample data - I want to get the "user" field, which is the "a" plus the 6 digits. I had rex "(?i)/.*?/(?P<FIELDNAME>[a-f0-9]+)(?=@)", but that didn't work.

2014-01-09T10:35:27.671644-05:00 hosta Juniper: 2014-01-09 10:35:27 - ive - [1.2.3.4] a123456(Mobile Web Cert)[Mobile] - Network Connect: Session started for user with IP 67.68.1.2, hostname a123456s-iPad

2014-01-09T10:34:40.618589-05:00 hosta Juniper: 2014-01-09 10:34:40 - ive - [7.8.9.0] a987654 JOE SCHMOE(Web Cert)[Full Access] - Network Connect: Session started for user with IP 1.2.3.4, hostname BLAH

Tags (1)
0 Karma
1 Solution

kristian_kolb
Ultra Champion

I would suggest;

... | rex "\]\s(?<user>a\d{6})"

/k

View solution in original post

arihant16cse
Path Finder

please check it .it is efficent respect to all possibilties.

0 Karma

lukejadamec
Super Champion

Try something like this:

search |rex ".*(?P<userID>[a]\d{6})"

kristian_kolb
Ultra Champion

I would suggest;

... | rex "\]\s(?<user>a\d{6})"

/k

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...