I have the following regex which works on regex101, but gives me an error when I try and use this within a Splunk query. Not sure if it's the fact that Im trying to escape the backslash that's causing the issue.
I have the field;
And I want to extract this into a field called NewUserName where it equals everything after the \ and up to closing quotes. So
NewUserName should be;
As I said, it works on Regex101 with the following;
But when I try it in Splunk via;
| rex field=_raw "ADMIN\\*(?P[^"]*)"
I get the error;
I think this should work as it will only pick the string in format "UserName\a123456" and not any string that starts with backslash :-
rex field =_raw "^".\(?P.)\""
I don't see your regex working in regex101 with the sample provided. This regex matches your sample in regex101...
so perhaps this would work in Splunk...
rex field=_raw "UserName\(?P