topic Extract username with comma in Security

Extract username with comma

loorimar — Mon, 30 Jan 2012 20:42:50 GMT

I have the following syslog

Jan 30 14:34:05 10.234.150.21 Jan 30 13:34:05 DEN-COLO-VBN-CTRL-01 stm[10699]: <305007> AP Smith, John replacement bootstrapped

I am trying to extract "John Smith" as the username. The closest I have gotten so far:

(?:[^-\n]*-){8}\d+\s+\d+.\d+.\d+.\d+>\s+\w+\s+(?P[^,]+),(?P\s+\w+)

which extracts "John" as the First Name and "Smith" as the last name. Can I concatenate the two somehow? Also having the username as "Smith, John" would work as well.

Any thoughts?

Re: Extract username with comma

Brian_Osburn — Mon, 30 Jan 2012 21:14:35 GMT

You can use an eval command to create a new field:

| eval fullname= fieldname1 . " " . fieldname2

That'll create a field called fullname that's = "John Smith"

Brian

Re: Extract username with comma

loorimar — Mon, 30 Jan 2012 21:19:03 GMT

Thanks Brian,

That's very cool. Ideally I would like to have this extracted into a single field at search time so I don't have to eval it as part of the search.