Splunk Enterprise Security

Extracting values from a field

moayadalghamdi
Path Finder

Hello Splunker

 

usernames in my environment are shown as  :

user=Company\username@AD#

 

where the # is a number

and some users are shown as:

user=Company\username$@AD#

 

the username has many variations"

  • only numbers
  • only letters
  • combination of both

 

i want to extract only the username with the other letters

 

thanks ^_^

Labels (1)
Tags (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Something like this?

| makeresults 
| eval _raw="user=Company\\username$@AD#
user=Company\\username@AD#"
| multikv noheader=t
| fields _raw



| rex "\\\(?<username>.+?)\$?\@"

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

Something like this?

| makeresults 
| eval _raw="user=Company\\username$@AD#
user=Company\\username@AD#"
| multikv noheader=t
| fields _raw



| rex "\\\(?<username>.+?)\$?\@"

View solution in original post

moayadalghamdi
Path Finder

sir you're a legend, thanks ^_^

 

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!