topic Regex: Help extracting user ID, session ID, and browser in Splunk Search

Regex: Help extracting user ID, session ID, and browser

reverse — Wed, 26 Jun 2019 17:45:16 GMT

2019.06.26 13.18.18.186 ERROR presentation [WebContainer : 5]: **********Browser information - ***********Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko ** Session ID is ** - xZB1wEDYSWWEOxE3Hh9ke1GWnsRuEyZRY_PtogsnSU28-17Wx ****** User ID ******uhyh\abcdefg** Is User using privacy/inCognito mode : **false** User using tab with ID : **2ee981ea-3eb4-4982-bdbb-6ff0d4a4c242

Please help me with extracting:

user id =uhyh\abcdefg
session id = xZB1wEDYSWWEOxE3Hh9ke1GWnsRuEyZRY_PtogsnSU28-17Wx
browser = Mozilla/5.0

Please guide.

Re: Regex: Help extracting user ID, session ID, and browser

reverse — Wed, 26 Jun 2019 17:45:50 GMT

Please guide. @jnudell_2 @Vijeta

Re: Regex: Help extracting user ID, session ID, and browser

Vijeta — Wed, 26 Jun 2019 17:56:44 GMT

@reverse - Use these for each field

| rex field=_raw "\*{0,10}Browser\s+information{0,20} - \*{0,20}(?<browser>.*) \(" | rex field=_raw "Session ID is \*{2} - (?<session>\S+)" | rex field=_raw "User ID \*{1,10}(?<user>\S+)\*{2}"

Re: Regex: Help extracting user ID, session ID, and browser

niketn — Wed, 26 Jun 2019 18:00:22 GMT

@reverse try the rex from the following run anywhere example | rex "Browser\sinformation\s\-\s\*+(?<BrowserInfo>[^\s]+).*Session ID is \*+\s\-\s(?<SessionID>[^\*]+)\*+\sUser\sID\s\*+(?<UserID>[^\*]+)\*+"

| makeresults
| eval _raw=" 2019.06.26 13.18.18.186 ERROR presentation [WebContainer : 5]: **********Browser information - ***********Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko ** Session ID is ** - xZB1wEDYSWWEOxE3Hh9ke1GWnsRuEyZRY_PtogsnSU28-17Wx ****** User ID ******uhyh\abcdefg** Is User using privacy/inCognito mode : **false** User using tab with ID : **2ee981ea-3eb4-4982-bdbb-6ff0d4a4c242"
| table _time _raw
| rex "Browser\sinformation\s\-\s\*+(?<BrowserInfo>[^\s]+).*Session ID is \*+\s\-\s(?<SessionID>[^\*]+)\*+\sUser\sID\s\*+(?<UserID>[^\*]+)\*+"

Re: Regex: Help extracting user ID, session ID, and browser

reverse — Wed, 26 Jun 2019 18:01:48 GMT

Amazing ..Thanks a ton!

Re: Regex: Help extracting user ID, session ID, and browser

reverse — Wed, 26 Jun 2019 18:24:36 GMT

one minor update @Vijeta .. i added ? after * to make it not greedy to match (.. there were many ( in my logs ..
by putting ? it worked perfectly ..