topic Regex Help! in Splunk Search

Regex Help!

NShimmen — Thu, 26 Apr 2018 14:05:41 GMT

Hi!

First time I am attempting Regex commands and I have got pretty stuck so any help would be much appreciated. I have a string data that appears in a table as "Network User::(FirstName).(Surname)".

How could I use the regex command to get rid of Network User and just display the first and second name in the results table?

So my search would be something like:

...| stats count by user|regex......| table user, count

Thanks!

Re: Regex Help!

David_Naylor — Thu, 26 Apr 2018 14:52:06 GMT

Try to get those field extractions done. You can do it inline with the following
|rex "Network\sUser::(?P\w+)).((?P\w+)) | table FirstName,Surname,count

Re: Regex Help!

damien_chillet — Thu, 26 Apr 2018 14:54:58 GMT

An example of regex extraction that would work with the example string you provided:

| rex field=user "::\((?P<first_name>[^\)]+)\)\.\((?P<surname>[^\)]+)\)"

Re: Regex Help!

TISKAR — Thu, 26 Apr 2018 15:37:00 GMT

Hello,
Try this:

.| stats count by user | rex field=a "::\((?<FirstName>[^.)]*)\)\.\((?<Surname>[^.)]*)"

For Example:

| makeresults |eval a= "Network User::(FirstName).(Surname)" | rex field=a "::\((?<FirstName>[^.)]*)\)\.\((?<Surname>[^.)]*)"

Re: Regex Help!

p_gurav — Thu, 26 Apr 2018 17:29:03 GMT

Can you try something:

...| stats count by user| rex field=user mode=sed "s/Network User::*//g" | table user, count