I have a simple search
index=xxxxx "User ID" and I need the correct syntax to get the actual username in the results.
Sample Event
INFO xcvxcvxcvxcvxcvxcvxcvxcvxcvxcvvcx - Logged User ID-XXXXXX
Now I can easy do a count of how many people logged on but need to report on the XXXXXX
I thought about doing
index=xxxxx 'User ID" | rex field=_raw "User\/s\ID\/-\(?<username>\d+)" | stats count by username
The search is returning the results and just a count but I need to see the username in my stats.
I am new to this so please mind the ignorance
The regular expression in the rex command has some misplaced escape characters that are preventing matches. Try this query
index=xxxxx 'User ID"
| rex field=_raw "User\sID-(?<username>\w+)"
| stats count by username
The regular expression in the rex command has some misplaced escape characters that are preventing matches. Try this query
index=xxxxx 'User ID"
| rex field=_raw "User\sID-(?<username>\w+)"
| stats count by username