Splunk Search

Rex extraction

redferrari
New Member

I have a field called "user", i'm trying to extract the username from the string and create a new field called extracted_user that I will later run against an LDAP filter to look up additional AD info.

user field examples:
Smith, John M. (jmsmith)(+)
Doe, Jane P. (jpdoe)(+)

I want to extract the username between the first set of parenthesis "jmsmith" and "jpdoe" respectively.

My current search:
index=network sourcetype=opsec app_rule_name="Track Uncategorized Content" user!=NULL
| rex field=user “((?.*))(“

Right now the search runs, but extracted_user field isn't created and the user field is unchanged. Any help would be greatly appreciated.

Tags (2)
0 Karma
1 Solution

cpetterborg
SplunkTrust
SplunkTrust

You need to escape the parentheses that are part of the string:

| rex field=user "\((?P<extracted_user>[^\(]+)\)\("

View solution in original post

gmchenry
Explorer

Try this:
| rex field=_raw "(?:()(?P\w+)"

I tested this at regex101.com and it seemed to do the trick.

0 Karma

cpetterborg
SplunkTrust
SplunkTrust

You need to escape the parentheses that are part of the string:

| rex field=user "\((?P<extracted_user>[^\(]+)\)\("

redferrari
New Member

Ohhh, thanks!

0 Karma

redferrari
New Member

| rex field=user “((?.*))(“

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...