Splunk Search

How to get each occurrence of the username in a search from my sample data, not just the first username?

rfiscus
Path Finder

This is my search:

index="test" sourcetype="Cisco_Users" 
| rex field=_raw "(?<Host>\w+-\w+-\w+-\w+-?\d?\.\w+\.\w+)\s\((?<IP>\d+\.\d+\.\d+\.\d+)"
| eval "IP Address" = IP
| rex field=_raw "(Version|version:)\s(?<IOS_Version>\d+.\d+\(\d+\)\w?\w?\w?)"
| eval "IOS Version" = IOS_Version
| rex field=_raw "(cisco|Hardware:)\s+(?<Model>\w+\s?-?\w+-?\w+)"
| rex field=_raw "(Serial Number:\s|Processor [B-B-b-b]oard ID )(?<Serial>\w+)"
| eval "Serial Number" = Serial
| rex field=_raw "username (?<Username>\w+)"
| table Host "IP Address" Model "IOS Version" "Serial Number" Username | Sort 0 Host

Sample Event:

TV-202-123-RT1.cbs.local (10.30.40.200):
Cisco IOS Software, C3750E Software (C3750E-IPBASEK9-M), Version 15.0(2)SE6, RELEASE SOFTWARE (fc2)
System image file is "flash:/c3750e-ipbasek9-mz.150-2.SE6/c3750e-ipbasek9-mz.150-2.SE6.bin"
cisco WS-C3750X-24 (PowerPC405) processor (revision A0) with 262144K bytes of memory.
Processor board ID FDO14
username user1 privilege 15 secret 5 
username user2 privilege 15 secret 5 
username user3 privilege 15 secret 5 
username user4 privilege 15 secret 5
username user5 privilege 15 secret 5
0 Karma
1 Solution

rfiscus
Path Finder

Bert from Splunk to the rescue again!!

| rex field=_raw max_match=50 "username (?<Username>\w+)"

View solution in original post

rfiscus
Path Finder

Bert from Splunk to the rescue again!!

| rex field=_raw max_match=50 "username (?<Username>\w+)"
Get Updates on the Splunk Community!

Index This | Why did the turkey cross the road?

November 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  &#x1f680; Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...