I am trying to rex out a person name out of the following....
.... @ xyz-2\\\\johndoe&........
Here is my current search:
sourcetype=A_cef_syslog category="ThisONe" | rex field=ThatONe "\@(?[\w+\d\-\\ ]+) " | stats list(person)
Ideally I would like the match to start with @
and stop at &
...
Any help is much appreciated,
thank you!!!
Try this
... | rex field=ThatONe "@(?<name>[^\&]+)" | ...
Thank you!!!
Lately I have been using online regex tester to test my rex code but apparently what works in the online tester doesn't always work... any other testing suggestions other than the obvious- "RTFM again" (which I am going to do)?