How do I extract using regex?

[sphiwee]

i have below result, how can I do a regex to extract the fields, first being DateTime, username, Action, Entity

2022-11-21 15:44:13,ea186520,CREATED,USERSESSIONLOG

[gcusello]

Hi @sphiwee,

you can use the Field User Extractor to extract these fields without using regexes, cebause they are comma separated fields.

If you want to use a regex, you can use this:

| rex "^(?<DateTime>[^,]*),(?<username>[^,]*),(?<Action>[^,]*),(?<Entity>[^,]*)"

that you can test at https://regex101.com/r/KMPkSa/1

Ciao.

Giuseppe

[yuanliu]

It quite depends on how stable is the actual data format.  If all values have no comma in them as illustrated, you can simply do

| rex "(?<DateTime>[^,]+, *(?<username>[^,]+), *(?<Action>[^,]+), *(?<Entity>[^,]+)"