Splunk Search

How to edit my regex to extract all user field values from my sample logs?

krasay
New Member

Here is the regex that I have:

^\(\d+\)\s+\d+/\d+/\d+\s+\d+:\d+:\d+\s+\w+\s+\-\s+\(\w+\s+\w+\s+\w+\)\s+\(\d+\.\d+\.\d+\.\d+\)>\s+\w+\s+\w+\s+\w+\s+\d+,\s+\w+\s+\w+\s+\w+\.\.\.\s+\(\d+\)\s+\d+/\d+/\d+\s+\d+:\d+:\d+\s+\w+\s+\-\s+\(\w+\s+\w+\s+\w+\)\s+\(\d+\.\d+\.\d+\.\d+\)>\s+\w+\s+(?P\w+)

I am trying to pick up the user name from this detail

(000019) 6/3/2016 16:01:02 PM - (not logged in) (xx.xxx.xxx.xxx)> Connected on port 7001, sending welcome message... 
(000019) 6/3/2016 16:01:27 PM - (not logged in) (xx.xxx.xxx.xxx)> USER CED\-nastot-coastallogic

and I have users like this in the same log

(000020) 6/3/2016 16:01:02 PM - (not logged in) (xx.xxx.xxx.xxx)> Connected on port 7001, sending welcome message... 
(000019) 6/3/2016 16:01:27 PM - (not logged in) (xx.xxx.xxx.xxx)> USER aa123

My regex will pick up the second user, but will not pick up the first. I only get CED. Can someone show me what needs to be added or removed to pickup both users? I don't mind if the user includes the CED\ with the full name.

0 Karma
1 Solution

sundareshr
Legend

Try this

... | rex "USER\s(?<user>.*)" | ...

View solution in original post

0 Karma

sundareshr
Legend

Try this

... | rex "USER\s(?<user>.*)" | ...
0 Karma

krasay
New Member

That works great, thank you!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...