topic Regex help please in Splunk Search

Regex help please

dmenon — Thu, 02 Apr 2020 15:51:28 GMT

I have field username - they show up as username=mike and in some cases username=mike. with a dot in the end. How do I remove the dot from end? This is messing my stats values(xyz) by username.

Re: Regex help please

gcusello — Thu, 02 Apr 2020 16:10:38 GMT

Hi @dmenon,
if you username hasn't spaces, you can try this:

| rex field=username "^(?<username>\w+)"

that you can test at https://regex101.com/r/mfLTm3/1

if instead you could have spaces in the username field, you could try this:

| rex field=username "^(?<username>.+)(\.|$)"

that you can test at https://regex101.com/r/mfLTm3/2

Ciao.
Giuseppe

Re: Regex help please

jpolvino — Thu, 02 Apr 2020 16:41:36 GMT

If a period is legal inside, but the line always has to end with a period, this might work for you:
|rex field=username "username=(?<username>.+)\.$"

Re: Regex help please

vinod94 — Thu, 02 Apr 2020 17:39:00 GMT

Hi dyude @dmenon ,

You can try this,

rex field=username "(?P<username>[^\.]+)"

Re: Regex help please

woodcock — Thu, 02 Apr 2020 22:56:22 GMT

There are many ways; here is one:

... | rex field=username mode=sed "s/\.+$//g"

Re: Regex help please

vnravikumar — Fri, 03 Apr 2020 03:01:02 GMT

Try this also

........| eval username=replace(username,".$","")