Splunk Search

How to regex information from two lines?

packet_hunter
Contributor

I am trying to create and add a regex stanza to Windows TA to parse out a username.
This is for event code 516 from a windows security event log.
The Windows TA does not parse out a username quite right.

The raw event writes the information on two separate lines.
...
User:
employeename@company.com
....

I started my stanza (with the help of regex101.com) but I am not having success writing a regex that matches [User: ] and then drops to the next line and copies the employee name out of the email address.

Here is my starting effort...

# Event Code 516 
[User:_as_user]
SOURCE_KEY = User:
REGEX = ???
FORMAT = ???

Please advise how it might be written. Please let me know if you need more information.

Thank you

Tags (1)
0 Karma
1 Solution

lukas_loder
Communicator

Hello packet_hunter

On regex101 this one works fine for me:

User:\n(?<User>.+)@

I just used your example

...
User:
employeename@company.com
....

and i get "employeename" as result. Have you tried this one?

View solution in original post

0 Karma

lukas_loder
Communicator

Hello packet_hunter

On regex101 this one works fine for me:

User:\n(?<User>.+)@

I just used your example

...
User:
employeename@company.com
....

and i get "employeename" as result. Have you tried this one?

0 Karma

packet_hunter
Contributor

yes this one gives just the name which is what I need.
Strange part is that when I use your regex on the entire _raw event, it does not work.
It works in the regex101 editor though...
Thanks

0 Karma

somesoni2
SplunkTrust
SplunkTrust

See if this works for you

props.conf on your search head

[YourSourceTypeName]
EXTRACT-username = User\:([\r\n]*)(?<UserName>\S+)

Regex101 link
https://regex101.com/r/9THuiH/1

0 Karma

packet_hunter
Contributor

Thank you, I will give it a try.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...