Splunk Search

How do you create a regex expression which creates a field and returns text after a backslash?

synking
Explorer

Hey,

i need assistance in trying to figure out how to create a field and extract the text after that. I am not sure how to go about doing this. i have looked in the documentation and on here for questions that are similar, but nothing i try seems to work. Basically, in the logs I am searching, there is a string:

SERVERNAME\USERNAME

I want to create a field called username from the above entry. There is always a space after and before those two words and always the backslash. Here is what i have so far:

rex field=_raw "SERVERNAME\\:\s+(?<USERNAME>[^\s]+)"

But, I am not sure what i am doing wrong. Any help is gladly accepted. Thanks.

Tags (2)
0 Karma
1 Solution

493669
Super Champion

@synking, try this:

|rex "SERVERNAME\s\\\s(?<username>[^\s]+)"

View solution in original post

493669
Super Champion

@synking, try this:

|rex "SERVERNAME\s\\\s(?<username>[^\s]+)"

synking
Explorer

Wait nvm it worked I was just putting it in the wrong field.

0 Karma

synking
Explorer

Thanks but even when i try that it does not seem to work. I get the search to complete but it shows everything in every log.

0 Karma
Get Updates on the Splunk Community!

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...

Splunk App Developers | .conf25 Recap & What’s Next

If you stopped by the Builder Bar at .conf25 this year, thank you! The retro tech beer garden vibes were ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...