Splunk Search

Field Extraction -- Break Field at Explicit Character

Contributor

All - I need someone to bring me sanity with a regex I am trying to write.

Essentially I want to capture everything after "username=" up to either "&" or "\s"

Two sample events:

Ex. 1

username=test%40bmcm%2ecom&version=5%2e4%2e0

Ex. 2

username=test%40bmcm%2ecom next_field

Right now my regex looks like this:

username=(?P[^&|^s]+)

Though I can get it to break on spaces, the regex will not break on "&". Can someone tell me where I'm going wrong, I'm sure it's embarrassingly simple!

Thanks!

0 Karma
1 Solution

SplunkTrust
SplunkTrust

Try:

username=(?P<username>[^\s&]+)

From regex101.com:

https://regex101.com/r/pNNiop/1

View solution in original post

0 Karma

Esteemed Legend

You are confusing character class (which does not need boolean joiners) with string literals (which do need boolean joiners); This should work:

(?ms)username=(?<username>[^&\s]+)
0 Karma

SplunkTrust
SplunkTrust

Try:

username=(?P<username>[^\s&]+)

From regex101.com:

https://regex101.com/r/pNNiop/1

View solution in original post

0 Karma