Regex Help

[sjangampeta]

Need help in removing double quotes from extracted field value.

EVAL-user = nullif(replace(user, "[^:]+:\s*(.*|\w+\,\s\w+\s{\w+})", "\1"),"")

Sample Log:
2017-02-12 14:02:05,Virus found,Source: Scheduled Scan,Risk name: OSX.Trojan.Gen,Occurrences: 1,/Users/71071190/Downloads/archive_manager.dmg,'',Actual action: Deleted,Requested action: Deleted,Secondary action: Deleted,Event time: 2017-02-08 22:38:17,Inserted: 2017-02-12 20:02:05,End: 2017-02-08 22:38:17,Last update time: 2017-02-12 20:02:05,Domain: North America,Group: My Company\North America\Workstations\Macs,User: "ABCD, XYZ {FGH}",Source computer: ,Source IP: ,Disposition: Good,Download site: null,Web domain: null,Downloaded by: null,Prevalence: Reputation was not used in this detection.,Confidence: Reputation was not used in this detection.,URL Tracking Status: Off,,First Seen: Reputation was not used in this detection.,Sensitivity: Low,MDS,Application hash: ,Hash type: SHA1,Company name: ,Application name: ,Application version: ,Application type: -1,File size (bytes): 0,Category set: Security risk,Category type: UNKNOWN
2017-02-12 14:02:05,Virus found,Source: Scheduled Scan,Risk name: OSX.Trojan.Gen,Occurrences: 1,/Users/71071190/Downloads/archive_manager.dmg,'',Actual action: Deleted,Requested action: Deleted,Secondary action: Deleted,Event time: 2017-02-08 22:38:17,Inserted: 2017-02-12 20:02:05,End: 2017-02-08 22:38:17,Last update time: 2017-02-12 20:02:05,Domain: North America,Group: My Company\North America\Workstations\Macs,User: 12345678,Source computer: ,Source IP: ,Disposition: Good,Download site: null,Web domain: null,Downloaded by: null,Prevalence: Reputation was not used in this detection.,Confidence: Reputation was not used in this detection.,URL Tracking Status: Off,,First Seen: Reputation was not used in this detection.,Sensitivity: Low,MDS,Application hash: ,Hash type: SHA1,Company name: ,Application name: ,Application version: ,Application type: -1,File size (bytes): 0,Category set: Security risk,Category type: UNKNOWN

Extracted values: -
user = 12345678
user= "ABCD, XYZ {FGH}"

[somesoni2]

Why not just do a search time field extraction like this.

props.conf on search head

[yoursourcetype]
EXTRACT-userfield = ,User:\s+\"*(?<user>.+)\"*,Source computer

See regex101 page for validation of regex
https://regex101.com/r/6e4pdb/1

[sjangampeta]

our requirement was to update above eval function, so it can extract all user fields. they don't want to add search time field extraction

[woodcock]

Like this:

EVAL-user=replace(user, "\"", "")

[sjangampeta]

since we already have existing eval-user, where can i add this "\"", "" regex ?

EVAL-user = nullif(replace(user, "[^:]+:\s*(.*|\w+\,\s\w+\s{\w+})", "\1"),"")

[woodcock]

You can do 2 passes; put mine after the original.

[sjangampeta]

Tried this, but it fails .new user value "ABCD, XYZ {FGH}"s/"/ /g

nullif(replace(user, "[^:]+:\s*(.*|\w+\,\s\w+\s{\w+})\"?", "s/\"/ /g\1"),"")

[sjangampeta]

may i know what I'm missing ?
nullif(replace(user, "[^:]+:\s*(.*|\w+\,\s\w+\s{\w+})\"?", "s/\"/ /g\1"),"")

[adayton20]

Try this:

| rex field=user mode=sed "s/\"/ /g"

[sjangampeta]

Thank you rex works.
But we don't want to add during search time.

Can I update anything in below calculated field?
EVAL-user = nullif(replace(user, "[^:]+:\s*(.*|\w+\,\s\w+\s{\w+})", "\1"),"")