Extract IP address and user name for log

[tevgey23]

Im trying to extract the IP address in the [] and the user name which follows it.
I tried a few different regex with no success.,

Any recommendations ?

May 16 15:39:57 192.x.x.x Juniper: 2013-05-16 16:39:58 - ive - [24.x.x.x] bob_b(Company - OTP)[VIT Users] - Key Exchange number 1 occured for user with NCIP 192.x.x.x

[kml_uvce]

try this

your search|rex field=_raw "(?i)[(?P[^]]+)"|rex field=_raw "(?i)^[^]]*]\s+(?P[^(]+)"

you can also combine these 2 fields in one rex.

[kristian_kolb]

Put this in your props.conf to get it all in one go. Assumes that the ip-address is inside the first set of square brackets in each event, and the username follows immediately after that (well, with a whitespace in between actually). The username can only contain A-Z, a-z, 0-9, - and _

[your sourcetype]
EXTRACT-get_stuff = ^[\[]+\[(?<ip_adress>[\]]+)\]\s+(?<user_name>[-\w]+)

/k

[kml_uvce]

Try these field extraction:

(?i) ive \- \[(?P<IP_Address>[^\]]+)
(?i) OTP\)\[(?P<User_Name>[^\]]+) when user is VIT Users

(?i)^[^\]]*\]\s+(?P<User_name>[^\(]+) when user is bob_b

[tevgey23]

Thank you for the reply. Seems to come up with an error

...| regex "(?i) ive - [(?P[^]]+)"

"Error in 'SearchOperator:regex': Usage: regex "(=|!=)