Correct Syntax for rex for a user

[LizAndy123]

I have a simple search 

index=xxxxx "User ID" and I need the correct syntax to get the actual username in the results.

Sample Event

INFO xcvxcvxcvxcvxcvxcvxcvxcvxcvxcvvcx - Logged User ID-XXXXXX

Now I can easy do a count of how many people logged on but need to report on the XXXXXX

I thought about doing

index=xxxxx 'User ID" | rex field=_raw "User\/s\ID\/-\(?<username>\d+)" | stats count by username

The search is returning the results and just a count but I need to see the username in my stats.

I am new to this so please mind the ignorance 

[richgalloway · Accepted solution]

The regular expression in the rex command has some misplaced escape characters that are preventing matches.  Try this query

index=xxxxx 'User ID" 
| rex field=_raw "User\sID-(?<username>\w+)" 
| stats count by username