All Apps and Add-ons

How could I extract a user ID using regex?

digital_alchemy
Path Finder

I have log data that contains userID and have not been able to extract the first few characters of the string.

Sample strings:

 (G477EFK@XYZ.LOCAL)
 (H587ABF@XYZ.LOCAL)
 (7P4LCDK@XYZ.LOCAL)

I only want the first four alphanumeric characters.
When I tried the interactive field extracter I can only get it to extract the full string usin it's suggested regex of:

 (?i)^(?:[^/]*/){4}\d+\)\s+(?P<FIELDNAME>[^ ]+)

I've tested this one with a regex tester online and it works for what I need but cant get it to work with Splunk.

[^(XYZ.local)](?:[a-z0-9]){4}

Any suggestions?

0 Karma
1 Solution

carasso
Splunk Employee
Splunk Employee

I wrote the interactive field extractor. It wasn't optimized to get the case where you want some alphanumeric characters that are touching other alphanumeric characters.

But the solution is simple.

Just go back into interactive field extractor, have it generate the regex:

(?i)^(?:[^/]*/){4}\d+\)\s+(?P<FIELDNAME>[^ ]+)

Then click "edit" and change the last "+" to a "{4}"

View solution in original post

0 Karma

carasso
Splunk Employee
Splunk Employee

I wrote the interactive field extractor. It wasn't optimized to get the case where you want some alphanumeric characters that are touching other alphanumeric characters.

But the solution is simple.

Just go back into interactive field extractor, have it generate the regex:

(?i)^(?:[^/]*/){4}\d+\)\s+(?P<FIELDNAME>[^ ]+)

Then click "edit" and change the last "+" to a "{4}"

0 Karma

Rob
Splunk Employee
Splunk Employee

This might be oversimplifying things a bit, but if you only want the first 4 alpha-numeric characters after the opening parentheses, would this do the job for you?

|rex field=_raw "\((?<first_4_char>\w{4})"

If you want to put the extraction in to your props.conf file (similar to how the interactive field extractor saves this) its simply:

[StanzaName]
EXTRACT-myExtract=\((?<first_4_char>\w{4})

After adding this line to your props.conf file, you an issue the following search command to reload the extractions:

| extract reload=T

kristian_kolb
Ultra Champion

through rex;

... | rex "\((?<your_field>\w{4})[^@]+@\w+\.\w+\)" | the rest of your search

/k

Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...