topic Re: How do you create a regex expression which creates a field and returns text after a backslash? in Splunk Search

How do you create a regex expression which creates a field and returns text after a backslash?

synking — Mon, 22 Oct 2018 13:19:38 GMT

Hey,

i need assistance in trying to figure out how to create a field and extract the text after that. I am not sure how to go about doing this. i have looked in the documentation and on here for questions that are similar, but nothing i try seems to work. Basically, in the logs I am searching, there is a string:

SERVERNAME\USERNAME

I want to create a field called username from the above entry. There is always a space after and before those two words and always the backslash. Here is what i have so far:

rex field=_raw "SERVERNAME\\:\s+(?<USERNAME>[^\s]+)"

But, I am not sure what i am doing wrong. Any help is gladly accepted. Thanks.

Re: How do you create a regex expression which creates a field and returns text after a backslash?

493669 — Mon, 22 Oct 2018 13:25:33 GMT

@synking, try this:

|rex "SERVERNAME\s\\\s(?<username>[^\s]+)"

Re: How do you create a regex expression which creates a field and returns text after a backslash?

synking — Mon, 22 Oct 2018 13:34:26 GMT

Thanks but even when i try that it does not seem to work. I get the search to complete but it shows everything in every log.

Re: How do you create a regex expression which creates a field and returns text after a backslash?

synking — Mon, 22 Oct 2018 13:46:26 GMT

Wait nvm it worked I was just putting it in the wrong field.