How to split one field into two using regex?

[Italy1358]

Hello, I am working on a Splunk query and I need help adjusting my rex command to get two fields that are in one field into their own fields. Example below:
index=test sourcetype=test category=test
| rex field=user "(?<region>[^\/]+)\/(?<username>[^\w].+)"
| fillnull t
| sort _time
| table _time, username, user, region, sourcetype,  result, t
| bin span=1d _time
| dedup t

The user field has: test\test1 and I need it to split that so username=test region=test1

[gcusello · Accepted solution]

Hi @Italy1358,

if the format of your user field is "test\test1", your regex is wrong, please try this:

| rex field=user "^(?<region>[^\\]+)\\(?<username>.+)"

that you can test at https://regex101.com/r/eLZV41/1

Ciao.

Giuseppe