Splunk Search

How do I extract the field "NAME" from my data?

gurpurspai
New Member

how do I extract the fourth field (NAME) from the following? I am very new to Splunk and regular expression.

Failed user login NAME IP address on device

Appreciate your guidance

0 Karma
1 Solution

gokadroid
Motivator

Try this
Your query to return events
| rex field=_raw "(?<field1>[\S]+)\s(?<field2>[\S]+)\s(?<field3>[\S]+)\s(?<myName>[\S]+)\s.*"
|table myName

OR try
Your query to return events
| rex "Failed\suser\slogin\s(?<myName>[\S]+)\s.*"
| table myName

View solution in original post

gurpurspai
New Member

No spaces in the NAME field.
The rex "...\ below resolved the issue
Thank you

0 Karma

rjthibod
Champion

Does the NAME field every contain spaces? If so, that makes this a bit harder unless you wrap the NAME in quotes.

0 Karma

gokadroid
Motivator

Try this
Your query to return events
| rex field=_raw "(?<field1>[\S]+)\s(?<field2>[\S]+)\s(?<field3>[\S]+)\s(?<myName>[\S]+)\s.*"
|table myName

OR try
Your query to return events
| rex "Failed\suser\slogin\s(?<myName>[\S]+)\s.*"
| table myName

Get Updates on the Splunk Community!

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...

Avoid Certificate Expiry Issues in Splunk Enterprise with Certificate Assist

This blog post is part 2 of 4 of a series on Splunk Assist. Click the links below to see the other ...