Palo Alto TA user field extraction issue

[jwalzerpitt]

Having an issue with trying to drop a prefix before the username field in the Palo Alto app. The username has the prefix of 'foo\' before the user name. I checked the props.conf file in the app to see the following stanza:

# Set user field
EVAL-user                            = coalesce(src_user,dest_user,"unknown")

I created a regex that I tested on regex101 which worked perfectly

,foo\\(?<user>[^,]+),

However, testing that regex in Splunk I get, "The regex '_raw=,foo(?[^,]+),' is invalid. Regex: unmatched closing parenthesis.
Any suggestions on how to get rid of the prefix and just keep the user name?

[jwalzerpitt]

Finally figured this out. Used the following which worked:

EXTRACT-foo_user = ,foo(?:\\\\|\\)(?<user>[^,]+),

[to4kawa]

props.conf

EVAL-user = trim(coalesce(src_user,dest_user,"unknown"),"foo\\")