Extracting users from a list

[ryangillan]

2020-10-19 05:00:03,744 INFO main() Deletion list: ['user1', 'user2', '$template', 'user233', 'svc_user1', ]

 I have this log file that outputs a list of users to be deleted.
I want to search this output and extract the users into fields then exclude the $template* & svc_users* users.

I have tried this to extract the users to field.

  search "list:" | eval del_users=split(_raw,"', '") | table del_users

output looks like:

2020-10-19 05:00:03,744 INFO main() Deletion list: ['user1

user2

$template

user233

svc_user1

Any suggestions to get a better output or how I should be doing this?

[ryangillan]

This looks like what I need.

|search "list:" | rex field=log "\[(?<del_users>.*)\, \]" | eval users=split(_raw,"', '") | mvexpand users
|search NOT users IN ("$*templat*","svc*") | table users

[vnravikumar · Accepted solution]

Hi

Try this

| rex field=log max_match=0 "\[{0,}\'(?P<output>[^',]+)" 
| mvexpand output 
| table output

[inventsekar]

did you check the "rex" regular expression...

| makeresults 
| eval log="2020-10-19 05:00:03,744 INFO main() Deletion list: ['user1', 'user2', '$template', 'user233', 'svc_user1', ]" 
| rex field=log "\[(?<del_users>.*)\, \]" 
| table del_users

EDIT - verified and adding the screenshot: