Splunk Enterprise

Rex field extraction

user93
Communicator

Hello,

I have a simple extraction I need to make on a new dataset that has not yet had the fields defined for me.

I want to extract the user name. The log structure is like so:

time stamp, server info, logstatus, userinfo, result

 

_raw= 2021-05-12 03:58:59,533 [#-####-abcd-#] INFO ServicesLogName#logStatus(): ## - User john.doe@username.com with IP 01.001.01.1 result [successful]

 

In every instance, the username value follows "User" and precedes "with IP" 

 

Index=basesearch application=specified
|rex field=_raw "(?<username>")

 

Thank you! 

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
Index=basesearch application=specified
|rex field=_raw "User\s(?<username>[^\s]+)\swith\sIP"

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
Index=basesearch application=specified
|rex field=_raw "User\s(?<username>[^\s]+)\swith\sIP"

View solution in original post

Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!