topic Re: How to extract the user and move it to a field in Splunk? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-extract-the-user-and-move-it-to-a-field-in-Splunk/m-p/632958#M219875 <P>I think&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/33901">@yuanliu</a>&nbsp;meant</P><LI-CODE lang="markup">| eval user = mvindex(split(xad, "/"), 2)</LI-CODE><P>Having said that, can you share the failed rex and/or the full events (anonymised, of course) in a code block &lt;/&gt; to preserve the format of the event?</P> Thu, 02 Mar 2023 10:32:51 GMT ITWhisperer 2023-03-02T10:32:51Z How to extract the user and move it to a field in Splunk? https://community.splunk.com/t5/Splunk-Search/How-to-extract-the-user-and-move-it-to-a-field-in-Splunk/m-p/632902#M219842 <P>How to extract the following user and move it to a field in Splunk?<BR />message: xad="/home/andy"<BR />message: xad="/home/george"<BR />message: xad="/home/cindy"<BR />and a lot more..<BR />I would like to get an output as follows.&nbsp;&nbsp;&nbsp; Because of the quote " before /home, Splunk rejected my regex. Please help. Thanks<BR />user&nbsp;&nbsp;<BR />==== &nbsp;&nbsp;&nbsp;<BR />andy<BR />george<BR />cindy</P> Thu, 02 Mar 2023 03:50:04 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-the-user-and-move-it-to-a-field-in-Splunk/m-p/632902#M219842 LearningGuy 2023-03-02T03:50:04Z Re: How to extract the user and move it to a field in Splunk? https://community.splunk.com/t5/Splunk-Search/How-to-extract-the-user-and-move-it-to-a-field-in-Splunk/m-p/632908#M219845 <P>You obviously has a field named xad. &nbsp;From this, no need for rex.</P><LI-CODE lang="markup">| eval user = mvindex(split(xad, "/"), 1)</LI-CODE> Thu, 02 Mar 2023 04:50:21 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-the-user-and-move-it-to-a-field-in-Splunk/m-p/632908#M219845 yuanliu 2023-03-02T04:50:21Z Re: How to extract the user and move it to a field in Splunk? https://community.splunk.com/t5/Splunk-Search/How-to-extract-the-user-and-move-it-to-a-field-in-Splunk/m-p/632958#M219875 <P>I think&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/33901">@yuanliu</a>&nbsp;meant</P><LI-CODE lang="markup">| eval user = mvindex(split(xad, "/"), 2)</LI-CODE><P>Having said that, can you share the failed rex and/or the full events (anonymised, of course) in a code block &lt;/&gt; to preserve the format of the event?</P> Thu, 02 Mar 2023 10:32:51 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-the-user-and-move-it-to-a-field-in-Splunk/m-p/632958#M219875 ITWhisperer 2023-03-02T10:32:51Z