How to remove a prefix on a field during search?

[aba83]

Hello, I'm trying to normalize a field during search. I have the field "user" and some of the fields are "NAU\abc123". I'm trying to remove the prefix "NAU\". All I want is the abc123 part of it. Is there a way to remove that prefix in search? Thanks in advance.

[adonio]

hello aba,
a little confusing as you suggest both "user" and "NAU\abc123" are fields, are NAU\abc123 fields or values under the field user?

[aba83]

Sorry, user is the column name. It's just sometimes those fields in the column populate either with just the abc123 or they populate with NAU\abc123. They aren't consistent. Sorry for the confusion. I'm trying to make it so every field in the user column is just the userid without the prefix "NAU\".

[kmorris_splunk · Accepted solution]

You can use rex in your search. Try this out.

[YOUR BASE SEARCH]
| rex field=user "\w{3}\\\(?<user2>\S+)"

[aba83]

This worked, thank you!

[cmerriman]

i think you have one extra backslash in here. \w{3}\\(?<user2>\S+)

[kmorris_splunk]

It was escaping the parenthesis with only 2. I had to add the extra. This is something to do with the Rex command.