topic Re: Extracting users from a list in Splunk Search

Extracting users from a list

ryangillan — Mon, 19 Oct 2020 02:50:15 GMT

2020-10-19 05:00:03,744 INFO main() Deletion list: ['user1', 'user2', '$template', 'user233', 'svc_user1', ]

I have this log file that outputs a list of users to be deleted.
I want to search this output and extract the users into fields then exclude the $template* & svc_users* users.

I have tried this to extract the users to field.

search "list:" | eval del_users=split(_raw,"', '") | table del_users

output looks like:

2020-10-19 05:00:03,744 INFO main() Deletion list: ['user1

user2

$template

user233

svc_user1

Any suggestions to get a better output or how I should be doing this?

Re: Extracting users from a list

inventsekar — Mon, 19 Oct 2020 03:32:12 GMT

did you check the "rex" regular expression...

| makeresults | eval log="2020-10-19 05:00:03,744 INFO main() Deletion list: ['user1', 'user2', '$template', 'user233', 'svc_user1', ]" | rex field=log "\[(?<del_users>.*)\, \]" | table del_users

EDIT - verified and adding the screenshot:

Re: Extracting users from a list

vnravikumar — Mon, 19 Oct 2020 10:38:57 GMT

Try this

| rex field=log max_match=0 "\[{0,}\'(?P<output>[^',]+)" | mvexpand output | table output

Re: Extracting users from a list

ryangillan — Tue, 20 Oct 2020 21:09:19 GMT

This looks like what I need.