Splunk Search

Field Extraction help for user and email

pavanae
Builder

The following is one of the sample raw logs.

01/14/19 2:05:25.000 PM

2019-01-14 19:05:24.915 INFO 1234 --- [abcd-2] AUDIT : Tim Tom (timtom@abc.com), SESSION_DESTROYED
2019-01-14 19:05:25.915 INFO 5678 --- [efgh-21] AUDIT : Jerry Tom (jerrytom@abc.com), SESSION_DESTROYED
2019-01-14 19:05:25.915 INFO 9101 --- [ijkl-32] AUDIT : ben ten (ben10@abc.com), SESSION_DESTROYED
2019-01-14 19:05:25.915 INFO 1213 --- [mnop-62] AUDIT : Jhonney S Depp (jhonydepp@abc.com), SESSION_DESTROYED

Now, how what could be regex's for creating fields for username, email as below

Username Email
Tim Tom timtom@abc.com

JerryTom jerrytom@abc.com

0 Karma

woodcock
Esteemed Legend

Try this:

... | rex "[^\]]+][^:]+:\s*(?<Username>[^(,]+(?<!\s))\s*\((?<Email>[^\)]+)"
0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try this (Inline in search, same regex can be used for saved field extraction)

your base search | rex "AUDIT\s+\:\s+(?<Username>[^\(]+)\((?<Email>[^\)]+)"
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...