https://community.splunk.com/t5/Security/extract-username-for-element-in-path/m-p/36302#M1210 <P>To do that inline in the search, you can use <CODE>rex</CODE> in the example below, look at the fourth element of the path (i.e. source);</P> <PRE><CODE>your search | rex field=source "/([^/]+/){3}(?&lt;username&gt;[^/]+)" </CODE></PRE> <P>/K</P> Thu, 16 May 2013 14:35:30 GMT kristian_kolb 2013-05-16T14:35:30Z https://community.splunk.com/t5/Security/extract-username-for-element-in-path/m-p/36301#M1209 <P>Hi, <BR /> Im new to regexes, and I'm trying to get the username field configuration to my extract-fields</P> <P>source:<BR /> /u01/somedir/somedir/user1/anotherfile<BR /> /u01/somedir/somedir/user3/anotherfile2<BR /> /u01/somedir/somedir/user4/anotherfile3</P> <P>I want to get the "user1|2|3" part to a username field.</P> <P>Any tips?<BR /> brgds/K</P> Thu, 16 May 2013 14:05:14 GMT https://community.splunk.com/t5/Security/extract-username-for-element-in-path/m-p/36301#M1209 kritho 2013-05-16T14:05:14Z https://community.splunk.com/t5/Security/extract-username-for-element-in-path/m-p/36302#M1210 <P>To do that inline in the search, you can use <CODE>rex</CODE> in the example below, look at the fourth element of the path (i.e. source);</P> <PRE><CODE>your search | rex field=source "/([^/]+/){3}(?&lt;username&gt;[^/]+)" </CODE></PRE> <P>/K</P> Thu, 16 May 2013 14:35:30 GMT https://community.splunk.com/t5/Security/extract-username-for-element-in-path/m-p/36302#M1210 kristian_kolb 2013-05-16T14:35:30Z