topic Re: How to extract username from my data? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-extract-username-from-my-data/m-p/274379#M82765 <P>you are amazing @somesoni2</P> <P>please explain regex Sir.</P> Thu, 02 Feb 2017 17:35:20 GMT thambisetty_bal 2017-02-02T17:35:20Z How to extract username from my data? https://community.splunk.com/t5/Splunk-Search/How-to-extract-username-from-my-data/m-p/274377#M82763 <P>Hi Splunkers,</P> <P>I have been struggling to extract user name from below values of user.</P> <PRE><CODE>user -------- user1@sa.com sab\user2 user3 OUTPUT ------------ user1 user2 user3 </CODE></PRE> <P>kindly help me out..</P> Thu, 02 Feb 2017 16:30:17 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-username-from-my-data/m-p/274377#M82763 thambisetty_bal 2017-02-02T16:30:17Z Re: How to extract username from my data? https://community.splunk.com/t5/Splunk-Search/How-to-extract-username-from-my-data/m-p/274378#M82764 <P>Give this a try. (Runanywhere sample search, first line is just to generate sample data).</P> <PRE><CODE>| gentimes start=-1 | eval user="user1@sa.com sab\user2 user3" | table user | makemv user | mvexpand user | rex field=user "(?&lt;cleanedUser&gt;\w+)(\@|$)" </CODE></PRE> Thu, 02 Feb 2017 17:05:05 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-username-from-my-data/m-p/274378#M82764 somesoni2 2017-02-02T17:05:05Z Re: How to extract username from my data? https://community.splunk.com/t5/Splunk-Search/How-to-extract-username-from-my-data/m-p/274379#M82765 <P>you are amazing @somesoni2</P> <P>please explain regex Sir.</P> Thu, 02 Feb 2017 17:35:20 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-username-from-my-data/m-p/274379#M82765 thambisetty_bal 2017-02-02T17:35:20Z Re: How to extract username from my data? https://community.splunk.com/t5/Splunk-Search/How-to-extract-username-from-my-data/m-p/274380#M82766 <P>It's capturing a full work (\w+) till you encounter a <CODE>@</CODE> symbol or end of value (<CODE>$</CODE>). backward slash is word terminator so it works for 2nd example value as well.</P> Thu, 02 Feb 2017 18:40:35 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-username-from-my-data/m-p/274380#M82766 somesoni2 2017-02-02T18:40:35Z