Help with regex

[surekhasplunk]

Hi,

I have below in column default_message

1st regex :

default_message= <14>shell: cmd by abcd: mkdir test

can you please help me with the regex to extract user here and the command run by the user in another column command. We can consider the : as the delimiter after user

here i should be able to extract user=abcd and command=mkdir test

2nd regex :

default_message= <133>clish[1234]: User abcd finished running clish -c from CLI shell

same column we need to extract user=abcd and command=finished running clish -c from CLI shell

Please help me with the regex.

If we can combine above two it would be great. else i will have to use some case and then do the regex.

Thanks

[thambisetty · Accepted solution]

1st regex 

|makeresults 
| eval _raw="default_message= <14>shell: cmd by abcd: mkdir test"
| rex "cmd by (?<user>[^\:]+): (?<command>[^\s]+)"

2nd regex will combine both and work for 1st and second:

|makeresults 
| eval test="default_message= <14>shell: cmd by abcd: mkdir test|default_message= <133>clish[1234]: User abcd finished running clish -c from CLI shell"
| makemv test delim="|"
| mvexpand test
| rex field=test "cmd by (?<user1>[^\:]+): (?<command1>[^\s]+)"
| rex field=test  "User (?<user2>[^\s]+) (?<command2>.*)"
| eval user=coalesce(user1,user2),command=coalesce(command1,command2)
| table test user command

[surekhasplunk]

Hi @thambisetty 

Thanks for your quick reply. 

It working well to extract user but command2 its showing only finished/running/logged. 

whereas i want the full text after the user2 field form the column. 

[thambisetty]

check updated answer. I misunderstood.

------------------------------

up vote if it works.