Splunk Search

How to get each occurrence of the username in a search from my sample data, not just the first username?

rfiscus
Path Finder

This is my search:

index="test" sourcetype="Cisco_Users" 
| rex field=_raw "(?<Host>\w+-\w+-\w+-\w+-?\d?\.\w+\.\w+)\s\((?<IP>\d+\.\d+\.\d+\.\d+)"
| eval "IP Address" = IP
| rex field=_raw "(Version|version:)\s(?<IOS_Version>\d+.\d+\(\d+\)\w?\w?\w?)"
| eval "IOS Version" = IOS_Version
| rex field=_raw "(cisco|Hardware:)\s+(?<Model>\w+\s?-?\w+-?\w+)"
| rex field=_raw "(Serial Number:\s|Processor [B-B-b-b]oard ID )(?<Serial>\w+)"
| eval "Serial Number" = Serial
| rex field=_raw "username (?<Username>\w+)"
| table Host "IP Address" Model "IOS Version" "Serial Number" Username | Sort 0 Host

Sample Event:

TV-202-123-RT1.cbs.local (10.30.40.200):
Cisco IOS Software, C3750E Software (C3750E-IPBASEK9-M), Version 15.0(2)SE6, RELEASE SOFTWARE (fc2)
System image file is "flash:/c3750e-ipbasek9-mz.150-2.SE6/c3750e-ipbasek9-mz.150-2.SE6.bin"
cisco WS-C3750X-24 (PowerPC405) processor (revision A0) with 262144K bytes of memory.
Processor board ID FDO14
username user1 privilege 15 secret 5 
username user2 privilege 15 secret 5 
username user3 privilege 15 secret 5 
username user4 privilege 15 secret 5
username user5 privilege 15 secret 5
0 Karma
1 Solution

rfiscus
Path Finder

Bert from Splunk to the rescue again!!

| rex field=_raw max_match=50 "username (?<Username>\w+)"

View solution in original post

rfiscus
Path Finder

Bert from Splunk to the rescue again!!

| rex field=_raw max_match=50 "username (?<Username>\w+)"
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...