topic Extracting a username from logs files using Regex in Splunk Search

Extracting a username from logs files using Regex

ifsuser — Wed, 04 Apr 2012 14:44:20 GMT

Hi im trying to extract domain usernames from my juniper log files using regex however depending on the log message the fully qualified domain name isnt always displayed

See example below:

line 1:      juniper -ive -] domain/user1(realm) etc. etc.
Line2:       juniper -ive -] user2(realm) etc. etc.

i would like to extract just the username into a group so i'm trying to exclude the word "DOMAIN/" so far i have this:

]\s(?!DOMAIN\/\b)([a-z_0-9]+)

however it only seems to capture user2

Thanks,

Re: Extracting a username from logs files using Regex

cvajs — Wed, 04 Apr 2012 15:35:23 GMT

does it support negative/positive lookahead and lookbehind?
your (?!) is a negative lookahead, you need a positive lookbehind if using "domain/"

maybe this
([A-Za-z]{1,10}([0-9]{1,5})?)(?=\()|(?<=/)([A-Za-z]{1,10}([0-9]{1,5})?)
or
([A-Za-z]{1,10}(\d+)?)(?=\()|(?<=/)([A-Za-z]{1,10}(\d+)?)

but a single pos lookahead should suffice
([A-Za-z]{1,10}(\d+)?)(?=\(realm\))

Re: Extracting a username from logs files using Regex

ziegfried — Wed, 04 Apr 2012 16:25:10 GMT

this one might work:

ive\s+-\]\s+((?<domain>\w+)/)?(?<user>\w+)\((?<realm>\w+)\)

Re: Extracting a username from logs files using Regex

RicoSuave — Wed, 04 Apr 2012 16:46:33 GMT

This should work too:

-]\s((?<domain>\w+)/)?(?<user>\w+)

🙂

Re: Extracting a username from logs files using Regex

ifsuser — Thu, 05 Apr 2012 10:10:25 GMT

Hi guys, neither of them worked, in the end i used this:

]\s(?:DOMAIN\*)?(.\w+)

but thanks anyways

Re: Extracting a username from logs files using Regex

RicoSuave — Thu, 05 Apr 2012 13:40:26 GMT

That's odd. I tested it and it works. But, if your regex is now working, that's all that matters. Cheers!

Re: Extracting a username from logs files using Regex

cvajs — Thu, 05 Apr 2012 18:32:20 GMT

pls escape backslashes with a \ otherwise we readers see confusing stuff because this forum takes a single \ as a special char. a real pita imho.