Parsing by regex

[ymalm188]

i need to parse this field   duser=DOMAIN\\User to only extract user without Domain\\

[isoutamo]

Hi

you can start with this with your actual data.

| makeresults 
| eval duser="DOMAIN\\\\User"
| rex field=duser "(?<=\\\\)(?<user>\w+)"

Probably you need to adjust the amount of \-characters?

See: https://regex101.com/r/6YF8BQ/1

r. Ismo 

[ymalm188]

i tried this and worked duser=Domain\\+(?<duser>\S+)

thank you

[ITWhisperer]

| rex field=duser "\\\\\\\\(?<user>.*)"