https://community.splunk.com/t5/Splunk-Enterprise-Security/Extracting-values-from-a-field/m-p/561669#M10156 <P>sir you're a legend, thanks ^_^</P><P>&nbsp;</P> Mon, 02 Aug 2021 09:17:38 GMT moayadalghamdi 2021-08-02T09:17:38Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Extracting-values-from-a-field/m-p/561659#M10154 <P>Hello Splunker</P><P>&nbsp;</P><P>usernames in my environment are shown as&nbsp; :</P><P>user=Company\username@AD#</P><P>&nbsp;</P><P>where the # is a number</P><P>and some users are shown as:</P><P>user=Company\username$@AD#</P><P>&nbsp;</P><P>the username has many variations"</P><UL><LI>only numbers</LI><LI>only letters</LI><LI>combination of both</LI></UL><P>&nbsp;</P><P>i want to extract only the username with the other letters</P><P>&nbsp;</P><P>thanks ^_^</P> Mon, 02 Aug 2021 08:13:09 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Extracting-values-from-a-field/m-p/561659#M10154 moayadalghamdi 2021-08-02T08:13:09Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Extracting-values-from-a-field/m-p/561661#M10155 <P>Something like this?</P><LI-CODE lang="markup">| makeresults | eval _raw="user=Company\\username$@AD# user=Company\\username@AD#" | multikv noheader=t | fields _raw | rex "\\\(?&lt;username&gt;.+?)\$?\@"</LI-CODE> Mon, 02 Aug 2021 08:49:56 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Extracting-values-from-a-field/m-p/561661#M10155 ITWhisperer 2021-08-02T08:49:56Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Extracting-values-from-a-field/m-p/561669#M10156 <P>sir you're a legend, thanks ^_^</P><P>&nbsp;</P> Mon, 02 Aug 2021 09:17:38 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Extracting-values-from-a-field/m-p/561669#M10156 moayadalghamdi 2021-08-02T09:17:38Z