I have authentication logs like below:
,AUTHN_METHOD_FOO,123!@#123!@#123!@#asdfgdvfd,123!@#123!@#123!@#asdfgdvfd,123!@#123!@#123!@#asdfgdvfd,123!@#123!@#123!@#asdfgdvfd,username,FIRST,LAST,
I want to use regex to build transform for a field called username and first and last
I had this but it didn't work
rex "(?i)AUTHN_METHOD_*+,*+,*+,*+,*+,(?P<username>[^,]+)"
Any help would be great!!!
Try this
rex "(?i)AUTHN_METHOD_\w+,.*,(?<username>[^,]+),(?<first>[^,]+),(?<last>[^,]+)"
Try this
rex "(?i)AUTHN_METHOD_\w+,.*,(?<username>[^,]+),(?<first>[^,]+),(?<last>[^,]+)"
Thanks, I have a problem becasue the \w+ could be one work or several like this "SUCCESS_TEMPORARY_FIXED_TOKENCODE" and the .* for the 4 sets of guid numbers seems odd