Splunk Search

Extracting a username from logs files using Regex

ifsuser
New Member

Hi im trying to extract domain usernames from my juniper log files using regex however depending on the log message the fully qualified domain name isnt always displayed

See example below:

line 1:      juniper -ive -] domain/user1(realm) etc. etc.
Line2:       juniper -ive -] user2(realm) etc. etc.

i would like to extract just the username into a group so i'm trying to exclude the word "DOMAIN/" so far i have this:

]\s(?!DOMAIN\/\b)([a-z_0-9]+)

however it only seems to capture user2

Thanks,

Tags (1)
0 Karma

ifsuser
New Member

Hi guys, neither of them worked, in the end i used this:

]\s(?:DOMAIN\*)?(.\w+)

but thanks anyways

0 Karma

cvajs
Contributor

pls escape backslashes with a \ otherwise we readers see confusing stuff because this forum takes a single \ as a special char. a real pita imho.

0 Karma

RicoSuave
Builder

That's odd. I tested it and it works. But, if your regex is now working, that's all that matters. Cheers!

0 Karma

RicoSuave
Builder

This should work too:

-]\s((?<domain>\w+)/)?(?<user>\w+)

🙂

0 Karma

ziegfried
Influencer

this one might work:

ive\s+-\]\s+((?<domain>\w+)/)?(?<user>\w+)\((?<realm>\w+)\)
0 Karma

cvajs
Contributor

does it support negative/positive lookahead and lookbehind?
your (?!) is a negative lookahead, you need a positive lookbehind if using "domain/"

maybe this
([A-Za-z]{1,10}([0-9]{1,5})?)(?=\()|(?<=/)([A-Za-z]{1,10}([0-9]{1,5})?)
or
([A-Za-z]{1,10}(\d+)?)(?=\()|(?<=/)([A-Za-z]{1,10}(\d+)?)

but a single pos lookahead should suffice
([A-Za-z]{1,10}(\d+)?)(?=\(realm\))

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...