Hello,
I have a simple extraction I need to make on a new dataset that has not yet had the fields defined for me.
I want to extract the user name. The log structure is like so:
time stamp, server info, logstatus, userinfo, result
_raw= 2021-05-12 03:58:59,533 [#-####-abcd-#] INFO ServicesLogName#logStatus(): ## - User [email protected] with IP 01.001.01.1 result [successful]
In every instance, the username value follows "User" and precedes "with IP"
Index=basesearch application=specified
|rex field=_raw "(?<username>")
Thank you!
