Splunk Search

Correct Syntax for rex for a user

LizAndy123
Explorer

I have a simple search 

index=xxxxx "User ID" and I need the correct syntax to get the actual username in the results.

Sample Event

INFO xcvxcvxcvxcvxcvxcvxcvxcvxcvxcvvcx - Logged User ID-XXXXXX

Now I can easy do a count of how many people logged on but need to report on the XXXXXX

I thought about doing

index=xxxxx 'User ID" | rex field=_raw "User\/s\ID\/-\(?<username>\d+)" | stats count by username

The search is returning the results and just a count but I need to see the username in my stats.

I am new to this so please mind the ignorance 

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The regular expression in the rex command has some misplaced escape characters that are preventing matches.  Try this query

index=xxxxx 'User ID" 
| rex field=_raw "User\sID-(?<username>\w+)" 
| stats count by username

 

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The regular expression in the rex command has some misplaced escape characters that are preventing matches.  Try this query

index=xxxxx 'User ID" 
| rex field=_raw "User\sID-(?<username>\w+)" 
| stats count by username

 

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...