All Apps and Add-ons

How could I extract a user ID using regex?

digital_alchemy
Path Finder

I have log data that contains userID and have not been able to extract the first few characters of the string.

Sample strings:

 (G477EFK@XYZ.LOCAL)
 (H587ABF@XYZ.LOCAL)
 (7P4LCDK@XYZ.LOCAL)

I only want the first four alphanumeric characters.
When I tried the interactive field extracter I can only get it to extract the full string usin it's suggested regex of:

 (?i)^(?:[^/]*/){4}\d+\)\s+(?P<FIELDNAME>[^ ]+)

I've tested this one with a regex tester online and it works for what I need but cant get it to work with Splunk.

[^(XYZ.local)](?:[a-z0-9]){4}

Any suggestions?

0 Karma
1 Solution

carasso
Splunk Employee
Splunk Employee

I wrote the interactive field extractor. It wasn't optimized to get the case where you want some alphanumeric characters that are touching other alphanumeric characters.

But the solution is simple.

Just go back into interactive field extractor, have it generate the regex:

(?i)^(?:[^/]*/){4}\d+\)\s+(?P<FIELDNAME>[^ ]+)

Then click "edit" and change the last "+" to a "{4}"

View solution in original post

0 Karma

carasso
Splunk Employee
Splunk Employee

I wrote the interactive field extractor. It wasn't optimized to get the case where you want some alphanumeric characters that are touching other alphanumeric characters.

But the solution is simple.

Just go back into interactive field extractor, have it generate the regex:

(?i)^(?:[^/]*/){4}\d+\)\s+(?P<FIELDNAME>[^ ]+)

Then click "edit" and change the last "+" to a "{4}"

View solution in original post

0 Karma

Rob
Splunk Employee
Splunk Employee

This might be oversimplifying things a bit, but if you only want the first 4 alpha-numeric characters after the opening parentheses, would this do the job for you?

|rex field=_raw "\((?<first_4_char>\w{4})"

If you want to put the extraction in to your props.conf file (similar to how the interactive field extractor saves this) its simply:

[StanzaName]
EXTRACT-myExtract=\((?<first_4_char>\w{4})

After adding this line to your props.conf file, you an issue the following search command to reload the extractions:

| extract reload=T

kristian_kolb
Ultra Champion

through rex;

... | rex "\((?<your_field>\w{4})[^@]+@\w+\.\w+\)" | the rest of your search

/k

Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!