topic Re: Regex Extraction in Splunk Search

topic Re: Regex Extraction in Splunk Search https://community.splunk.com/t5/Splunk-Search/Regex-Extraction/m-p/583756#M203284 <P>Either of these should work:</P><P>^.*\/(?<user_id>.*)</P><P>^[^\/]*\/\/[^\/]*\/(?<user_id>.*)</P> Fri, 04 Feb 2022 18:16:43 GMT johnhuang 2022-02-04T18:16:43Z Regex Extraction https://community.splunk.com/t5/Splunk-Search/Regex-Extraction/m-p/583754#M203282 <P>How do i extract everything after the 3rd / from the left in:</P><P><SPAN>WinNT://PSAD/johndoe</SPAN></P><P>The output should be "johndoe"</P><P>Thanks in advance for your assistance!</P> Fri, 04 Feb 2022 18:04:18 GMT https://community.splunk.com/t5/Splunk-Search/Regex-Extraction/m-p/583754#M203282 mdeterville 2022-02-04T18:04:18Z Re: Regex Extraction https://community.splunk.com/t5/Splunk-Search/Regex-Extraction/m-p/583756#M203284 <P>Either of these should work:</P><P>^.*\/(?<user_id>.*)</P><P>^[^\/]*\/\/[^\/]*\/(?<user_id>.*)</P> Fri, 04 Feb 2022 18:16:43 GMT https://community.splunk.com/t5/Splunk-Search/Regex-Extraction/m-p/583756#M203284 johnhuang 2022-02-04T18:16:43Z