Rex field extraction

[user93]

Hello,

I have a simple extraction I need to make on a new dataset that has not yet had the fields defined for me.

I want to extract the user name. The log structure is like so:

time stamp, server info, logstatus, userinfo, result

_raw= 2021-05-12 03:58:59,533 [#-####-abcd-#] INFO ServicesLogName#logStatus(): ## - User john.doe@username.com with IP 01.001.01.1 result [successful]

In every instance, the username value follows "User" and precedes "with IP" 

Index=basesearch application=specified
|rex field=_raw "(?<username>")

Thank you! 

[ITWhisperer · Accepted solution]

Index=basesearch application=specified
|rex field=_raw "User\s(?<username>[^\s]+)\swith\sIP"