topic Re: Advise a rex for domain\username example windows\mathews in Splunk Search

Advise a rex for domain\username example windows\mathews

LintuMathews — Fri, 10 Apr 2015 05:57:07 GMT

can you please advise a rex for domain\username example windows\mathews

Below is sample of event I am trying to extract

http://windows/corp/it/us\x00\x00admin/forms/allitems.aspx\x00windows\mathews\x00

Re: Advise a rex for domain\username example windows\mathews

somesoni2 — Fri, 10 Apr 2015 06:18:37 GMT

Give this a try

Updated

your base search | rex field=yourfieldname  "windows\\\\(?<UserName>\w+)"

Runanywhere sample search

| gentimes start=-1 | eval temp="http://windows/corp/it/us\x00\x00admin/forms/allitems.aspx\x00windows\mathews\x00" | table temp | rex field=temp "windows\\\\(?<UserName>\w+)"

Re: Advise a rex for domain\username example windows\mathews

LintuMathews — Fri, 10 Apr 2015 06:53:42 GMT

Didn't work out, the domain name here "windows`mathews`" where "windows" is like a static domain name i have in all the logs meaning I dont have anyother domains except "windows", I just want to grab the username out of it

Re: Advise a rex for domain\username example windows\mathews

somesoni2 — Fri, 10 Apr 2015 07:01:16 GMT

try the updated query

Re: Advise a rex for domain\username example windows\mathews

Skippy — Fri, 10 Apr 2015 10:10:30 GMT

That will work if your usernames only ever contain a-z 0-9 or _

This one will match any character up to a \

your base search | rex field=yourfieldname "windows\\(?.+?)\"

Re: Advise a rex for domain\username example windows\mathews

LintuMathews — Fri, 10 Apr 2015 21:11:07 GMT

I was hoping something like this would work, this was generated through the erex , but needs some adjustments i guess

rex "(?i)windows\(?P[^\]+)"