How to change a rex field extraction to an inputs.conf file?

[Splunkster45]

Here I am asking another question, but I think that this one will help me with other questions that I've had.

Currently, I've been using the rex command rex field=_raw ".*Login succeeded for user: (?.*)" to extract a user from a log file. However, this has been making other things more difficult such as tags and lookup files. I'm interested in setting this in the inputs.conf file so that the field username will be logged automatically.

http://docs.splunk.com/Documentation/Splunk/6.1.3/admin/inputsconf

It looks like regex is the key to capturing the 'user' information. I'm a little familiar with regex, but am not exactly sure of how to do this.
I believe that the code will look something like the following:

user = ".*Login succeeded for user: (?<user>.*)"
user = ".*Login failed for user: (?<user>.*)"

Does this appears to be correct?
Does calling one field a second time overide the first value or does it find all criteria that match both instances?

Unfortunately, where I work I can't update my own file and implement it. I have to send the updated inputs.conf file off to another team who will implement it. This means that I'll need to get it right the first time and am limited in the amount of testing that I can do.

Currently, our inputs.conf file has 3 components: location of log file, index and sourcetype

Thanks in advance!

[aweitzman · Accepted solution]

This looks to me like more of a job for props.conf than inputs.conf. It might look something like this:

props.conf

[appropriate-sourcetype-goes-here]
EXTRACT-user = Login (succeeded|failed) for user: (?<user>.*)

See http://docs.splunk.com/Documentation/Splunk/6.1.3/Knowledge/Createandmaintainsearch-timefieldextract... for more info on ways to do this.

[gkanapathy]

You can also do this thru the Admin/Management UI, if your admins will let you. You do not have to edit the files directly.