Getting Data In

unable to retrieve string from a big string with special symbols. Any help?

Engager

Hi Wish to retrieve hammadahmad from below string. Below string contain html tag ( & a p o s ; ) without space.

  • String = &a pos;hammadahmad&ap os; (service Active Directory)
  • Current Regular Expression : | rex "Session login, user(?P/<USER/>.*?)logging in from machine"

alt text

Any help will be appreciated.

0 Karma

Splunk Employee
Splunk Employee
rex field=USERNAME "&apos;(?<user>\S+)&apos;"
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!