I'm trying to extract the userid field but am not able to get a clean extraction. I've tried several combinations all have different issues and are not exact.
FAILED REGEX Attempts:
^(?:[^[\n][){8}(?P[^]]+)
^(?:[^:\n]:){7}\s+(?P\w+)
^[^)\n]*)']\s+[\w+:\s+(?P\w+)
data sub set:
[2016-05-03T23:59:57.225-05:00] [gw_server1] [NOTIFICATION] [] [com.charter.care.customer.view.device.backing.deviceStatusFlow.DeviceStatusManager] [tid: [ACTIVE].ExecuteThread: '26' for queue: 'weblogic.kernel.Default (self-tuning)'] [userId: nhorsley] [ecid: a44b71a4-e0b3-420d-9d59-fd890c508729-0024359c,0] [APP: chtrgwy] DM-provisioning-operation = REPROVISION_PHONE_INTERNET Account = 8357190022950*** Mac = 001dd6725*** AuditUser = CHTRGWY:nhorsley Status = INFO: QTS retry number 2 for order ID 50487161 - Location-JobCode-JobTitle - CC-Louisville Call Center-D713-Cust Rel Coord-Internet/Phone
VALID
[2016-05-03T23:59:56.390-05:00] [gw_server1] [NOTIFICATION] [] [com.charter.care.customer.memo.model.dao.MemoServiceHelper] [tid: [ACTIVE].ExecuteThread: '28' for queue: 'weblogic.kernel.Default (self-tuning)'] [userId: sshimin] [ecid: a44b71a4-e0b3-420d-9d59-fd890c508729-00243595,0] [APP: chtrgwy] 2016-05-03 23:59:56.39 - ADD MEMO PROCESSED - 8345780100010*** - UI0 - Caller verified - CC-Louisville Call Center-D719-Cust Rel Coord-Comm Repair
VALID
[2016-05-03T23:59:56.357-05:00] [gw_server3] [NOTIFICATION] [] [com.charter.customer.care.view.backing.banner.BannerFlowManager] [tid: [ACTIVE].ExecuteThread: '27' for queue: 'weblogic.kernel.Default (self-tuning)'] [userId: bxburns] [ecid: 1ca25884-aa12-4021-a3c7-b7865adbba6f-002474e8,0] [APP: chtrgwy] 2016-05-03 23:59:56.357 - TROUBLESHOOTING2 TAB CLICK - 8351200211445*** - HIR - CC-Louisville Call Center-D713-Cust Rel Coord-Internet/Phone
VALID
[2016-05-03T23:59:56.193-05:00] [gw_server1] [NOTIFICATION] [] [com.charter.care.customer.memo.model.dao.MemoServiceHelper] [tid: [ACTIVE].ExecuteThread: '28' for queue: 'weblogic.kernel.Default (self-tuning)'] [userId: sshimin] [ecid: a44b71a4-e0b3-420d-9d59-fd890c508729-00243595,0] [APP: chtrgwy] 2016-05-03 23:59:56.193 - ADD MEMO INITIATED - 8345780100010*** - UI0 - Caller verified - CC-Louisville Call Center-D719-Cust Rel Coord-Comm Repair
VALID
[2016-05-03T23:59:56.193-05:00] [gw_server1] [NOTIFICATION] [] [com.charter.customer.care.view.backing.banner.BannerFlowManager] [tid: [ACTIVE].ExecuteThread: '28' for queue: 'weblogic.kernel.Default (self-tuning)'] [userId: sshimin] [ecid: a44b71a4-e0b3-420d-9d59-fd890c508729-00243595,0] [APP: chtrgwy] 2016-05-03 23:59:56.193 - ACCOUNT VERIFIED - 8345780100010*** - UI0 - CC-Louisville Call Center-D719-Cust Rel Coord-Comm Repair
Thanks everybody!
i show ra01 regexr today and then he uses it to one up me on an answer 😜
I argue my regex is more efficient though !!!
I have a section about using regexr in my work wiki I wrote on Splunk. 😉
I'm sure there's more efficient ways to write the expression.
Yep, i confused you with someone else I worked with today. My apologies. Great site though!
Hello,
How about:
"\[userId:\s(?<userID>[^\]]+)"
I tried with this, and it worked:
|stats count | eval test="[com.charter.care.customer.view.device.backing.deviceStatusFlow.DeviceStatusManager] [tid: [ACTIVE].ExecuteThread: '26' for queue: 'weblogic.kernel.Default (self-tuning)'] [userId: nhorsley] [ecid: a44b71a4-e0b3-420d-9d59-fd890c508729-0024359c,0] [APP: chtrgwy] DM-provisioning-operation = REPROVISION_PHONE_INTERNET Account = 8357190022950* Mac = 001dd6725 AuditUser = CHTRGWY:nhorsley Status = INFO: QTS retry number 2 for order ID 50487161 - Location-JobCode-JobTitle - CC-Louisville Call Center-D713-Cust Rel Coord-Internet/Phone" | rex field=test "\[userId:\s(?<userID>[^\]]+)"
This is a good way of testing regular expressions. Thanks!
Hi & good morning,
Let us know if this works:
userId:\s(?<userId>\w+)