topic Re: another rex question in Splunk Search

another rex question

packet_hunter — Thu, 02 Jun 2016 18:15:06 GMT

Scenario, I have a field (msg) below and I need to extract the user id which is user = [abcdefg]

field msg = AAA user accounting Successful : server = 192.168.0.1 : user = abcdefg

index = main | rex field=msg [?] ....

I need the abcdefg portion.
Thank you!

richgalloway — Thu, 02 Jun 2016 18:19:51 GMT

Assuming the value is terminated by a space, this should do the job.

... | rex field=msg "user = (?<user>[^ ]*)" | ...

packet_hunter — Thu, 02 Jun 2016 18:30:50 GMT

only getting a single character under stats list(user)

richgalloway — Thu, 02 Jun 2016 18:33:51 GMT

I forgot the quantifier (*). Try the updated answer.

packet_hunter — Thu, 02 Jun 2016 18:36:22 GMT

Thank you, will have to test later, someone just restarted my indexer....

packet_hunter — Thu, 02 Jun 2016 18:39:00 GMT

Sweet!!!! it works great! Thank you