topic Re: Extract the userID in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-extract-the-userID/m-p/610303#M212235 <LI-CODE lang="markup">| rex "User Login to KTB Successful\s-\s[^\-]+\-\s(?&lt;user&gt;\S+)"</LI-CODE> Mon, 22 Aug 2022 09:02:36 GMT ITWhisperer 2022-08-22T09:02:36Z How to extract the userID? https://community.splunk.com/t5/Splunk-Search/How-to-extract-the-userID/m-p/610301#M212234 <P>Hi</P> <P>I want to extract the unique user ID for the users that are successfully logging in the KTB system</P> <P>[2/11/00 12:45:35:039 ISTT] 00000115 SystemOut O User Login to KTB Successful - Bhatur- NT-000-TTT - PT-P065-APT<BR />[2/11/00&nbsp; 9:27:26:877 ISTT] 00001309 SystemOut O User Login to KTB Successful - Bhatur- AM1353P - STYLE P Harry<BR /><BR /></P> <P>Output should be:</P> <P>NT-000-TTT</P> <P>AM1353P</P> <P>&nbsp;</P> Mon, 22 Aug 2022 12:13:00 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-the-userID/m-p/610301#M212234 tankhanandita 2022-08-22T12:13:00Z Re: Extract the userID https://community.splunk.com/t5/Splunk-Search/How-to-extract-the-userID/m-p/610303#M212235 <LI-CODE lang="markup">| rex "User Login to KTB Successful\s-\s[^\-]+\-\s(?&lt;user&gt;\S+)"</LI-CODE> Mon, 22 Aug 2022 09:02:36 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-the-userID/m-p/610303#M212235 ITWhisperer 2022-08-22T09:02:36Z