Any regex masters out there?

[tkwaller]

Working on a regex for a script log. Need to pull out user:

User accounts for \\
-------------------------------------------------------------------------------
Administrator            Guest                    SMSNomadP2P&            
The command completed with one or more errors.

Would work for the first account but wont grab the rest

-\s(?<field1>\S+)

Any ideas?
Thanks in advance!

[woodcock · Accepted solution]

That was pretty tough; try this:

(?ms)(?<=[\r\n]|\s{2})(?<field1>[^\r\n\s\-]+)(?=.*[\r\n])

This captures every username, regardless of how many appear, as a multi-valued field.

[tkwaller]

@woodcock Nice work man, I banged my head on this one for a while before posting here and quite a while after.
+1000 points for that work man, I appreciate it greatly

[tkwaller]

btw threw that in a transform and added mv_add = true then updated props......good to go
Thanks again

[adauria_splunk]

Awesome. Another thing to consider: If you use this in a rex command, you might need to set the max_match parameter to something other than 1.

[DalJeanis]

Once you remove that hyphen off the front, that regex matches each of them, according to regex101.com. Your regex depends on there being a whitespace character immediately before the value you are trying to pull. Check to validate that there is one. Can you show us what the entire line of data looks like?

[tkwaller]

That IS the entire log, nothing more to show. If you remove the hypen it matches much more than the account names according to regex101.com, I used the hypen to match the beginning.

[DalJeanis]

ah, so it's a single multi-line returned value, and you only want the line immediately after the line of hyphens. Got it.

[somesoni2]

What values you wan to capture, Administrator, Guest, SMSNomadP2P& or all?

[tkwaller]

yes just the user names