topic Is there a way to extract fields which is : separated in Splunk Search

Is there a way to extract fields which is : separated

Hema_Nithya — Tue, 07 Nov 2023 17:53:17 GMT

John:x:/home/John:/bin/bash

is there a way to extract the field from above with colon separated. We have many users in the above format from /etc/passwd

John - username

x - passwd

/home/John - path

ITWhisperer — Tue, 07 Nov 2023 18:19:09 GMT

| rex "(?<username>[^:]+):(?<passwd>[^:]+):(?<path>[^:]+)"

Hema_Nithya — Tue, 07 Nov 2023 19:16:57 GMT

Thank you , let me check and update you !

Hema_Nithya — Tue, 28 Nov 2023 07:51:46 GMT

How to deal with the empty fields between . Example there is empty field between passwd and after home directory

userid:passwd: :/home/John: :

ITWhisperer — Tue, 28 Nov 2023 09:21:45 GMT

| rex "(?<username>[^:]*):(?<passwd>[^:]*):(?<path>[^:]*)"