topic Re: How to regex information from two lines? in Splunk Search

How to regex information from two lines?

packet_hunter — Thu, 08 Jun 2017 20:57:29 GMT

I am trying to create and add a regex stanza to Windows TA to parse out a username.
This is for event code 516 from a windows security event log.
The Windows TA does not parse out a username quite right.

The raw event writes the information on two separate lines.
...
User:
employeename@company.com
....

I started my stanza (with the help of regex101.com) but I am not having success writing a regex that matches [User: ] and then drops to the next line and copies the employee name out of the email address.

Here is my starting effort...

# Event Code 516 
[User:_as_user]
SOURCE_KEY = User:
REGEX = ???
FORMAT = ???

Please advise how it might be written. Please let me know if you need more information.

Thank you

Re: How to regex information from two lines?

somesoni2 — Thu, 08 Jun 2017 21:12:38 GMT

See if this works for you

props.conf on your search head

[YourSourceTypeName]
EXTRACT-username = User\:([\r\n]*)(?<UserName>\S+)

Regex101 link
https://regex101.com/r/9THuiH/1

Re: How to regex information from two lines?

lukas_loder — Thu, 08 Jun 2017 21:18:45 GMT

Hello packet_hunter

On regex101 this one works fine for me:

User:\n(?<User>.+)@

I just used your example

...
User:
employeename@company.com
....

and i get "employeename" as result. Have you tried this one?

Re: How to regex information from two lines?

packet_hunter — Thu, 08 Jun 2017 21:24:17 GMT

Thank you, I will give it a try.

Re: How to regex information from two lines?

packet_hunter — Thu, 08 Jun 2017 21:29:52 GMT

yes this one gives just the name which is what I need.
Strange part is that when I use your regex on the entire _raw event, it does not work.
It works in the regex101 editor though...
Thanks