topic Re: Finding logs with special characters in Splunk Cloud Platform

Finding logs with special characters

binay2634 — Wed, 06 Dec 2023 11:34:19 GMT

Hi All,

I have been trying to extract userids which has special characters in it but with no luck.

For ex let's say a field name uid contains two userids one is "roboticts@gmail.com" and the other one is "difficult+1@gmail.com".

Now I want to write a query which could extract only the uid with + sign in it. Please help on this

ITWhisperer — Wed, 06 Dec 2023 14:34:37 GMT

Assuming only 1 + and user id is in quotes.

| rex "(?<userid>[^\"]+\+[^\"]+@[^\"]+)"

binay2634 — Thu, 07 Dec 2023 13:35:47 GMT

Thank you for suggesting, it worked