Splunk Search

Field extraction stanza help in props.conf?

Builder

I have the username filed extraction as follows in the props.conf which extracts the username:-

[sourcetype_X]
EXTRACT-XYZ = username="(?<user>[^+\"]*)"

which extracts the field as follows

x12345@abc-def-ghij-01.com
y67891@klm-def-ghij-01.com
z45787@abc-def-ghij-01.com
ABC-DEF

Now what would be regex stanza to extract the username as follows from the above

x12345
y67891
z45787
ABC-DEF
0 Karma
1 Solution

SplunkTrust
SplunkTrust

Three things to do:

  • include the @ sign in your negated character class
  • remove the tailing double quote
  • replace the * with a + to avoid empty usernames

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

Three things to do:

  • include the @ sign in your negated character class
  • remove the tailing double quote
  • replace the * with a + to avoid empty usernames

View solution in original post

0 Karma

Builder

Thanks @martin_mueller could you provide me the new regex as mentioned above. I might have missing something.

0 Karma

Explorer

^(.+?)@ ie everything before the @ sign if that's a pattern

0 Karma