How to extract field from source field? - Splunk Community

Splunk Search

I am trying extract "user20" from rest of "_9a4ab75c_239_process.log". tried multiple ways but unable to separate the user name from underscore.

/app_5/appname/appanem2/logs/agent-machine4/sre/query/prot/user20_tt65rft67uu87_process.log"

| rex field=source "/(?<user>[^_/]+)[^/]+\.log$"

Get Updates on the Splunk Community!

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

Now On Demand Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research ...

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...