Having an issue with trying to drop a prefix before the username field in the Palo Alto app. The username has the prefix of 'foo\' before the user name. I checked the props.conf file in the app to see the following stanza:
# Set user field
EVAL-user = coalesce(src_user,dest_user,"unknown")
I created a regex that I tested on regex101 which worked perfectly
,foo\\(?<user>[^,]+),
However, testing that regex in Splunk I get, "The regex '_raw=,foo(?[^,]+),' is invalid. Regex: unmatched closing parenthesis.
Any suggestions on how to get rid of the prefix and just keep the user name?
Finally figured this out. Used the following which worked:
EXTRACT-foo_user = ,foo(?:\\\\|\\)(?<user>[^,]+),
props.conf
EVAL-user = trim(coalesce(src_user,dest_user,"unknown"),"foo\\")