Splunk Search

How do I extract the field "NAME" from my data?

gurpurspai
New Member

how do I extract the fourth field (NAME) from the following? I am very new to Splunk and regular expression.

Failed user login NAME IP address on device

Appreciate your guidance

0 Karma
1 Solution

gokadroid
Motivator

Try this
Your query to return events
| rex field=_raw "(?<field1>[\S]+)\s(?<field2>[\S]+)\s(?<field3>[\S]+)\s(?<myName>[\S]+)\s.*"
|table myName

OR try
Your query to return events
| rex "Failed\suser\slogin\s(?<myName>[\S]+)\s.*"
| table myName

View solution in original post

gurpurspai
New Member

No spaces in the NAME field.
The rex "...\ below resolved the issue
Thank you

0 Karma

rjthibod
Champion

Does the NAME field every contain spaces? If so, that makes this a bit harder unless you wrap the NAME in quotes.

0 Karma

gokadroid
Motivator

Try this
Your query to return events
| rex field=_raw "(?<field1>[\S]+)\s(?<field2>[\S]+)\s(?<field3>[\S]+)\s(?<myName>[\S]+)\s.*"
|table myName

OR try
Your query to return events
| rex "Failed\suser\slogin\s(?<myName>[\S]+)\s.*"
| table myName

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...