topic Re: rex extraction user & module in Splunk Search

rex extraction user & module

indeed_2000 — Thu, 15 Jul 2021 17:45:55 GMT

Here is my log, what is the rex for extract "0000A0@#0000" and "mymodulename"

2021-07-14 23:59:05,185 INFO [APP] User: 0000A0@#0000 || module: mymodulename

any idea?

Thanks

Re: rex extraction user & module

efika — Thu, 15 Jul 2021 19:48:02 GMT

rex "User\:(?<user>.+)\s\|\|\smodule\:(?<module>.+)"

(field=_raw is added by default)

Re: rex extraction user & module

venkatasri — Fri, 16 Jul 2021 00:48:46 GMT

Hi @indeed_2000

Can you try this?

<your_search_goes_here> | rex "User\:\s+(?<user>\S+)\s\|\|\smodule\:\s+(?<module>.+)$" | table user module

---

An upvote would be appreciated and Accept the solution if this reply helps!

Re: rex extraction user & module

indeed_2000 — Fri, 16 Jul 2021 05:59:17 GMT

thank you for answer, it's not work on all user & module name (both might have capital word or special character)

e.g.

2021-07-14 23:53:23,353 INFO [APP] User: A0000@#0000 || module: setNameDescription

2021-07-14 23:53:23,353 INFO [APP] User: A.Kay || module: setNameDescription

2021-07-14 23:53:23,353 INFO [APP] User: b_Kay || module: setNameDescription

any idea?

Thanks,

Re: rex extraction user & module

venkatasri — Fri, 16 Jul 2021 05:22:26 GMT

@indeed_2000 What you have originally provided having different log structure. User: || module:

These new logs having User: || method hence rex provided only works for module. Which one are correct events?

Re: rex extraction user & module

venkatasri — Fri, 16 Jul 2021 05:25:18 GMT

@indeed_2000 This one works for method.

<your_search> | rex "User\:\s+(?<user>\S+)\s+\|\|\s+method:\s+(?<method>\S+)$" | table user method

An upvote would be appreciated and accept solution if this reply helps!

Re: rex extraction user & module

efika — Fri, 16 Jul 2021 05:28:01 GMT

Not a problem. use:

rex "User\:(?<user>.+)\s\|\|\s(module\:(?<module>.+)|method\:(?<method>.+))"

Re: rex extraction user & module

indeed_2000 — Fri, 16 Jul 2021 06:01:42 GMT

sorry for miss spelling it is module I modify last reply.

and try this but not work

rex "User\:(?<user>.+)\s\|\|\s(module\:(?<module>.+)"

Any idea?

Thanks

Re: rex extraction user & module

indeed_2000 — Fri, 16 Jul 2021 06:04:49 GMT

it worked! thank you! 🙂

replace it with module