How could I extract a user ID using regex?

[digital_alchemy]

I have log data that contains userID and have not been able to extract the first few characters of the string.

Sample strings:

 (G477EFK@XYZ.LOCAL)
 (H587ABF@XYZ.LOCAL)
 (7P4LCDK@XYZ.LOCAL)

I only want the first four alphanumeric characters.
When I tried the interactive field extracter I can only get it to extract the full string usin it's suggested regex of:

 (?i)^(?:[^/]*/){4}\d+\)\s+(?P<FIELDNAME>[^ ]+)

I've tested this one with a regex tester online and it works for what I need but cant get it to work with Splunk.

[^(XYZ.local)](?:[a-z0-9]){4}

Any suggestions?

[carasso · Accepted solution]

I wrote the interactive field extractor. It wasn't optimized to get the case where you want some alphanumeric characters that are touching other alphanumeric characters.

But the solution is simple.

Just go back into interactive field extractor, have it generate the regex:

(?i)^(?:[^/]*/){4}\d+\)\s+(?P<FIELDNAME>[^ ]+)

Then click "edit" and change the last "+" to a "{4}"

[Rob]

This might be oversimplifying things a bit, but if you only want the first 4 alpha-numeric characters after the opening parentheses, would this do the job for you?

|rex field=_raw "\((?<first_4_char>\w{4})"

If you want to put the extraction in to your props.conf file (similar to how the interactive field extractor saves this) its simply:

[StanzaName]
EXTRACT-myExtract=\((?<first_4_char>\w{4})

After adding this line to your props.conf file, you an issue the following search command to reload the extractions:

| extract reload=T

[kristian_kolb]

through rex;

... | rex "\((?<your_field>\w{4})[^@]+@\w+\.\w+\)" | the rest of your search

/k