usernames in my environment are shown as :
where the # is a number
and some users are shown as:
the username has many variations"
i want to extract only the username with the other letters
Something like this?
| eval _raw="user=Company\\username$@AD#
| multikv noheader=t
| fields _raw
| rex "\\\(?<username>.+?)\$?\@"
View solution in original post
sir you're a legend, thanks ^_^