topic filter text using rex in Splunk Search

filter text using rex

nwayoonyanmin — Fri, 12 May 2023 06:50:02 GMT

i can't extract the exact text using rex command .
e.g

User: This is my user Name\n This is just some random text

i want to extract a new filed which values is "This is my user Name"

Re: filter text using rex

bowesmana — Fri, 12 May 2023 06:40:40 GMT

|rex "User:\"(?<username>[^\"]*)"

will extract from the _raw field starting from the character following the first quote after User: up to the first quote.

Re: filter text using rex

nwayoonyanmin — Fri, 12 May 2023 06:43:01 GMT

oh my bad , "" will not exist everytime , the thing for sure and
will start from ':' and end with '\n' . I try using this | rex field=msg "User:\s(?<user>.+)"
but can't get rid of \n

Re: filter text using rex

bowesmana — Fri, 12 May 2023 06:55:52 GMT

Is the \n 2 characters or a line feed?

Re: filter text using rex

nwayoonyanmin — Fri, 12 May 2023 06:57:49 GMT

in my log it's literally "\n" not next line when i extract something it looks like this

user1\n

but i want only user1 , not \n

Re: filter text using rex

bowesmana — Fri, 12 May 2023 06:58:18 GMT

If it's a literal \n then

| rex "User:\s+?(?<username>.*)\\\\n"

If it's a line feed then

| rex "User:\s+?(?<username>.*)\n"

Re: filter text using rex

bowesmana — Fri, 12 May 2023 06:58:47 GMT

You need 4 slashes in the regex for a single match

Re: filter text using rex

nwayoonyanmin — Fri, 12 May 2023 07:02:39 GMT

i don't know what is wrong i can't get it work
| rex field=msg "User:\s(?<user>.*)\\\\n"
this is my query and it doesn't stop at \n

user\n and this text also