topic Re: rex extraction in Splunk Search

rex extraction

a212830 — Thu, 09 Jan 2014 15:51:38 GMT

Hi,

I'm trying to extract a field via rex for a search and having problems. Hoping someone could help me...

Here's some sample data - I want to get the "user" field, which is the "a" plus the 6 digits. I had rex "(?i)/.*?/(?P<FIELDNAME>[a-f0-9]+)(?=@)", but that didn't work.

2014-01-09T10:35:27.671644-05:00 hosta Juniper: 2014-01-09 10:35:27 - ive - [1.2.3.4] a123456(Mobile Web Cert)[Mobile] - Network Connect: Session started for user with IP 67.68.1.2, hostname a123456s-iPad

2014-01-09T10:34:40.618589-05:00 hosta Juniper: 2014-01-09 10:34:40 - ive - [7.8.9.0] a987654 JOE SCHMOE(Web Cert)[Full Access] - Network Connect: Session started for user with IP 1.2.3.4, hostname BLAH

Re: rex extraction

kristian_kolb — Thu, 09 Jan 2014 15:57:56 GMT

I would suggest;

... | rex "\]\s(?<user>a\d{6})"

Re: rex extraction

lukejadamec — Thu, 09 Jan 2014 16:06:52 GMT

Try something like this:

search |rex ".*(?P<userID>[a]\d{6})"

Re: rex extraction

arihant16cse — Thu, 07 Feb 2019 06:16:27 GMT

please check it .it is efficent respect to all possibilties.