How to fetch the User from Raw Data

[aditsss]

Hi Team,

I have one Requirement.

I have the below raw Logs that are coming different format . Below are some Examples:

2021-02-12 09:22:32,936 INFO [ Web -4092] AuthenticationFilter Attempting request for (<asriva22><lgposputb500910.ghp.bcp.com><CN=lgposputb50010.ghp.aexp.com, OU=Middleware Utilities, O=ABC  Company, L=Phoenix, ST=Arizona

2021-02-12 09:22:38,689 INFO [ Web -4099] o.a.n.w.s.AuthenticationFilter Authentication success for smennen

2021-02-12 08:45:05,277 INFO [Web -3253] o.a.n.w.s.AuthenticationFilter Attempting request for (<JWT token>) GET https://ebac/api/flow/controller/bulletins

I want to extract the highlighted field as Request User.

Can someone guide me How can I do that.

Thanks in advance

[ITWhisperer]

Try these

| rex "Attempting request for \(\<(?<user>[^\>]+)\>"
| rex "Authentication success for (?<user>\w+)"

[ITWhisperer · Accepted solution]

Try this

<query>index=abc  sourcetype=xyz  source="user.log" $process_tok1$
| rex field=_raw "(?&lt;id&gt;[A_Za-z0-9]{8}[\-][A_Za-z0-9]{4}[\-][A_Za-z0-9]{4}[\-][A_Za-z0-9]{4}[\-][A_Za-z0-9]{12})"
| rex "Attempting request for \\(\\&lt;(?&lt;user&gt;[^\\&gt;]+)\\&gt;"
| rex "Authentication success for (?&lt;user&gt;\\w+)"
| join type=outer id [inputlookup parent_chains_e1.csv]|search $ckey$|search $Name$|eval ClickHere=url|rex field=url mode=sed "s/\\/\\//\\//g s/https:/https:\\//g"
| table _time _raw host id parent_chain url</query>

[aditsss]

@ITWhisperer 

I want only one field for the user . How can I achieve this from two rex.

Can you guide me.

[ITWhisperer]

The rex use the same field name - for those events that match the first rex will get the field set and those which match the second rex will also get the field. If the event matches neither rex, it won't have the field

[aditsss]

@ITWhisperer 

Below is my current query:

<query>index=abc  sourcetype=xyz  source="user.log" $process_tok1$
| rex field=_raw "(?&lt;id&gt;[A_Za-z0-9]{8}[\-][A_Za-z0-9]{4}[\-][A_Za-z0-9]{4}[\-][A_Za-z0-9]{4}[\-][A_Za-z0-9]{12})"
| join type=outer id [inputlookup parent_chains_e1.csv]|search $ckey$|search $Name$|eval ClickHere=url|rex field=url mode=sed "s/\\/\\//\\//g s/https:/https:\\//g"
| table _time _raw host id parent_chain url</query>

Can you guide me how can I used both rex in this query and fetch user