topic Field Extraction -- Break Field at Explicit Character in Splunk Search

Field Extraction -- Break Field at Explicit Character

himynamesdave — Mon, 11 Sep 2017 17:28:54 GMT

All - I need someone to bring me sanity with a regex I am trying to write.

Essentially I want to capture everything after "username=" up to either "&" or "\s"

Two sample events:

Ex. 1

username=test%40bmcm%2ecom&version=5%2e4%2e0

Ex. 2

username=test%40bmcm%2ecom next_field

Right now my regex looks like this:

username=(?P[^&|^s]+)

Though I can get it to break on spaces, the regex will not break on "&". Can someone tell me where I'm going wrong, I'm sure it's embarrassingly simple!

Thanks!

Re: Field Extraction -- Break Field at Explicit Character

cpetterborg — Mon, 11 Sep 2017 17:42:02 GMT

Try:

username=(?P<username>[^\s&]+)

From regex101.com:

https://regex101.com/r/pNNiop/1

Re: Field Extraction -- Break Field at Explicit Character

woodcock — Tue, 12 Sep 2017 05:24:06 GMT

You are confusing character class (which does not need boolean joiners) with string literals (which do need boolean joiners); This should work:

(?ms)username=(?<username>[^&\s]+)