Splunk Search

Field extraction stanza help in props.conf?

Builder

I have the username filed extraction as follows in the props.conf which extracts the username:-

[sourcetype_X]
EXTRACT-XYZ = username="(?<user>[^+\"]*)"

which extracts the field as follows

x12345@abc-def-ghij-01.com
y67891@klm-def-ghij-01.com
z45787@abc-def-ghij-01.com
ABC-DEF

Now what would be regex stanza to extract the username as follows from the above

x12345
y67891
z45787
ABC-DEF
0 Karma
1 Solution

SplunkTrust
SplunkTrust

Three things to do:

  • include the @ sign in your negated character class
  • remove the tailing double quote
  • replace the * with a + to avoid empty usernames

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

Three things to do:

  • include the @ sign in your negated character class
  • remove the tailing double quote
  • replace the * with a + to avoid empty usernames

View solution in original post

0 Karma

Builder

Thanks @martin_mueller could you provide me the new regex as mentioned above. I might have missing something.

0 Karma

Explorer

^(.+?)@ ie everything before the @ sign if that's a pattern

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!