Correct Syntax for rex for a user

LizAndy123 — Wed, 01 May 2024 18:15:40 GMT

I have a simple search

index=xxxxx "User ID" and I need the correct syntax to get the actual username in the results.

Sample Event

INFO xcvxcvxcvxcvxcvxcvxcvxcvxcvxcvvcx - Logged User ID-XXXXXX

Now I can easy do a count of how many people logged on but need to report on the XXXXXX

I thought about doing

index=xxxxx 'User ID" | rex field=_raw "User\/s\ID\/-\(?<username>\d+)" | stats count by username

The search is returning the results and just a count but I need to see the username in my stats.

I am new to this so please mind the ignorance

Re: Correct Syntax for rex for a user

richgalloway — Wed, 01 May 2024 18:30:18 GMT

The regular expression in the rex command has some misplaced escape characters that are preventing matches. Try this query

index=xxxxx 'User ID" | rex field=_raw "User\sID-(?<username>\w+)" | stats count by username