Splunk Enterprise

Parsing by regex

ymalm188
Explorer

i need to parse this field   duser=DOMAIN\\User to only extract user without Domain\\

Labels (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

you can start with this with your actual data.

| makeresults 
| eval duser="DOMAIN\\\\User"
| rex field=duser "(?<=\\\\)(?<user>\w+)"

Probably you need to adjust the amount of \-characters?

See: https://regex101.com/r/6YF8BQ/1

r. Ismo 

ymalm188
Explorer

i tried this and worked duser=Domain\\+(?<duser>\S+)

 

thank you

Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| rex field=duser "\\\\\\\\(?<user>.*)"
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...