Extracting values from a field

[moayadalghamdi]

Hello Splunker

usernames in my environment are shown as  :

user=Company\username@AD#

where the # is a number

and some users are shown as:

user=Company\username$@AD#

the username has many variations"

• only numbers
• only letters
• combination of both

i want to extract only the username with the other letters

thanks ^_^

[ITWhisperer · Accepted solution]

Something like this?

| makeresults 
| eval _raw="user=Company\\username$@AD#
user=Company\\username@AD#"
| multikv noheader=t
| fields _raw



| rex "\\\(?<username>.+?)\$?\@"

[moayadalghamdi]

sir you're a legend, thanks ^_^