How do i capture login ID as the same field across two differently-formatted logs?

[a212830]

Hi,

Looking for ideas on how to attack a problem...

I have a couple of different systems (servers and vpn's) and I need to show login id's that have been used on both. I have the login message for both systems, but the format is different. How do I capture the login id across both feeds, using the same field?

For example:

message 1: User1 logged in...
message 2: mm/dd/yyy system abc - User1 logged in

I want to run a search to grab the "user" and map it to one field, across both feeds?

[somesoni2]

If the format of your userid is X123456 (start with character and then bunch of digits), following regex should be able to extract userid from any place within the string.

| rex field=_raw "(?<userId>[a-zA-Z][0-9][^ ]+)"

[kristian_kolb]

But you run the risk of getting some other useless info this way. With a pattern so unspecific, you basically need to anchor the regex to some known surrounding string.

[ShaneNewman]

You can use the rex command if you want to do it in the search bar. If not, you can move the regex to the props.conf and transforms.conf to make it automatic.

 your search | rex "(?<user_id>\w+)\slogged\sin"

This regex will work for both cases, assuming that the user id's are [A-Za-Z0-9_]. If other characters can be expected you will have to account for that by changing the \w+ to [\w(your other chars)]+

[somesoni2]

Then can you provide more examples? a complete _raw values would be great.

[a212830]

Thanks everyone. I did a bad job on the examples. My login id is in the format d123450. However, that could be anywhere in the event. How would I grab that, since it could be anywhere, and, more importantly, how do I look for that id across two different searches?

[kristian_kolb]

To make the extractions more permanent;

props.conf
[server_sourcetype]
EXTRACT-srv_login = (?<userID>\w+)\slogged\sin

[vpn_sourcetype]
EXTRACT-vpn_login = (?<userID>\w+)\slogged\sin

[ShaneNewman]

field=_raw is implied if you don't specify it. Although, I do put it in all of mine, just for good practice.

[lukejadamec]

your search | rex field=_raw "(?\w+)\slogged\sin"