Another regular expression/rex field extraction question: How do I get USERID between timestamp and '@JavaClient' ?
Does USERID always have to begin with (?< and end with >.*) ?
What syntax represents all of these to use rex command ?
number, integer, and digit
date time (specific format? )
letter
special characters
Currently, I have it like this but it's not returning XBATCH, and ABCSRV
| rex field=_raw "\.\d\d\d\s(?.*)\@JavaClient\s"
Raw data
PSAPPSRV.3204 (770) [2017-01-12T15:00:32.028 XBATCH@JavaClient IntegrationSvc](3) Returning context. ID=XBATCH, Lang=ENG, UStreamId=150032028_3204.770, Token=DU_CS/2017-01-12-09.00.31.708254/XBATCH/ENG/B82gf3Amj/f5Lx/k1J4f6t9RRtI=
PSAPPSRV.3204 (771) [2017-01-12T15:01:02.551 GetCertificate](3) Returning context. ID=SRBTTRAN, Lang=ENG, UStreamId=150102551_3204.771, Token=DU_CS/2017-01-12-09.01.02.708281/SRBTTRAN/ENG/o0fY1oj0zd5Es1vl3xMOnUaB5t0=
PSAPPSRV.3204 (785) [2017-01-12T15:01:05.037 ABCSRV@JavaClient IntegrationSvc](3) Processing WssecIsAuthenticatedUser command. CtxUser=ABCSRV/ENG, SwUser=XBATCH/+
PSAPPSRV.3204 (785) [2017-01-12T15:01:05.037 ABCSRV@JavaClient IntegrationSvc](3) Processing SwitchUser command. CtxUser=ABCSRV/ENG, SwUser=DPRBATCH/+, SwConnInfo=-, SwToken=-
... View more