https://community.splunk.com/t5/Splunk-Search/Regex-for-filed-extraction/m-p/150397#M42146 <P>If your sourcetype is syslog, and you have <A href="http://apps.splunk.com/app/833/">Splunk_TA_nix</A> installed, you should get the user information that you want. If you really want it all in one field, you could try this in your props.conf:</P> <PRE><CODE>[mysourcetype] REPORT-myfield = myfield </CODE></PRE> <P>Then in your transforms.conf</P> <PRE><CODE>[myfield] REGEX = (\w{3}\s+\d+\s+\d{2}:\d{2}:\d{2}).*Accepted\spassword\sfor\s(\S+) FORMAT = myfield::Time:$1 &amp; User=$2 </CODE></PRE> <P>Not positive about the spaces in the FORMAT section, but it's a start.</P> <P>HTH</P> <P>Dave</P> Fri, 14 Feb 2014 05:27:41 GMT dshpritz 2014-02-14T05:27:41Z https://community.splunk.com/t5/Splunk-Search/Regex-for-filed-extraction/m-p/150396#M42145 <P>Feb 13 22:01:25 XXXINFQST03 sshd[9161]: Accepted password for admin from </P> <P>Above is the message I am getting from Linux logs from which I want to create fileds like </P> <P>Time:Feb 13 22:01:25 &amp; User=admin </P> <P>Can anyone provide me the regex for this or any other way ??</P> <P>Help apprecieted .. </P> Fri, 14 Feb 2014 04:12:41 GMT https://community.splunk.com/t5/Splunk-Search/Regex-for-filed-extraction/m-p/150396#M42145 darshan_singh01 2014-02-14T04:12:41Z https://community.splunk.com/t5/Splunk-Search/Regex-for-filed-extraction/m-p/150397#M42146 <P>If your sourcetype is syslog, and you have <A href="http://apps.splunk.com/app/833/">Splunk_TA_nix</A> installed, you should get the user information that you want. If you really want it all in one field, you could try this in your props.conf:</P> <PRE><CODE>[mysourcetype] REPORT-myfield = myfield </CODE></PRE> <P>Then in your transforms.conf</P> <PRE><CODE>[myfield] REGEX = (\w{3}\s+\d+\s+\d{2}:\d{2}:\d{2}).*Accepted\spassword\sfor\s(\S+) FORMAT = myfield::Time:$1 &amp; User=$2 </CODE></PRE> <P>Not positive about the spaces in the FORMAT section, but it's a start.</P> <P>HTH</P> <P>Dave</P> Fri, 14 Feb 2014 05:27:41 GMT https://community.splunk.com/t5/Splunk-Search/Regex-for-filed-extraction/m-p/150397#M42146 dshpritz 2014-02-14T05:27:41Z