All Apps and Add-ons

How could I extract a user ID using regex?

digital_alchemy
Path Finder

I have log data that contains userID and have not been able to extract the first few characters of the string.

Sample strings:

 (G477EFK@XYZ.LOCAL)
 (H587ABF@XYZ.LOCAL)
 (7P4LCDK@XYZ.LOCAL)

I only want the first four alphanumeric characters.
When I tried the interactive field extracter I can only get it to extract the full string usin it's suggested regex of:

 (?i)^(?:[^/]*/){4}\d+\)\s+(?P<FIELDNAME>[^ ]+)

I've tested this one with a regex tester online and it works for what I need but cant get it to work with Splunk.

[^(XYZ.local)](?:[a-z0-9]){4}

Any suggestions?

0 Karma
1 Solution

carasso
Splunk Employee
Splunk Employee

I wrote the interactive field extractor. It wasn't optimized to get the case where you want some alphanumeric characters that are touching other alphanumeric characters.

But the solution is simple.

Just go back into interactive field extractor, have it generate the regex:

(?i)^(?:[^/]*/){4}\d+\)\s+(?P<FIELDNAME>[^ ]+)

Then click "edit" and change the last "+" to a "{4}"

View solution in original post

0 Karma

carasso
Splunk Employee
Splunk Employee

I wrote the interactive field extractor. It wasn't optimized to get the case where you want some alphanumeric characters that are touching other alphanumeric characters.

But the solution is simple.

Just go back into interactive field extractor, have it generate the regex:

(?i)^(?:[^/]*/){4}\d+\)\s+(?P<FIELDNAME>[^ ]+)

Then click "edit" and change the last "+" to a "{4}"

0 Karma

Rob
Splunk Employee
Splunk Employee

This might be oversimplifying things a bit, but if you only want the first 4 alpha-numeric characters after the opening parentheses, would this do the job for you?

|rex field=_raw "\((?<first_4_char>\w{4})"

If you want to put the extraction in to your props.conf file (similar to how the interactive field extractor saves this) its simply:

[StanzaName]
EXTRACT-myExtract=\((?<first_4_char>\w{4})

After adding this line to your props.conf file, you an issue the following search command to reload the extractions:

| extract reload=T

kristian_kolb
Ultra Champion

through rex;

... | rex "\((?<your_field>\w{4})[^@]+@\w+\.\w+\)" | the rest of your search

/k

Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...