Extracting Fields using Regex

EHariharan · ‎07-22-2019

Hi All,

TIME_PREFIX=
MAX_TIME_LOOKAHEAD=
LINE_BREAKER=

Below are the logs which need to be extracted. Kindly help!

LOGID USERTYPE OPERATORUSER OPERATORTYPE OPERATORNAME OPERATORTIME

6 ma*ge_an userClass deleteUser 2019-06-28 09:50:26
7 System administrator mage_a***n userClass createUser 2019-06-28 09:50:3

Thanks in Advance!

chinmoya · ‎07-22-2019

it looks like all your headers are separated by a tab.
I would suggest you not use regex instead use a delimiter based approach with using tab as a delimiter.

Extracting Fields using Regex

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Your Feedback. Our Roadmap. Visit the PX Feedback Booth at .conf26

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

Painting a Clearer Picture: Creating Cross-Domain Visibility with AI Canvas

Join the Conversation

Extracting Fields using Regex

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Your Feedback. Our Roadmap. Visit the PX Feedback Booth at .conf26

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

Painting a Clearer Picture: Creating Cross-Domain Visibility with AI Canvas