How to search for only select users based on a regex extract

[LizAndy123]

So I have the following setup and everything is good but I want to kind of do a subsearch

In the Event - Sample

User-ABCDEF assigned Role-'READ' on Project-1234 to GHIJKL

Current SPL 

index="xxxx" "role-'WRITE'" OR "role-'READ'"
| rex "User-(?<userid>[^,]*)"
| rex "(?<resource>\w+)$"
| eval userid=upper(userid)
| stats c as Count latest(_time) as _time by userid

I get an output as this

ABCDEF ASSIGNED ROLE-'READ' ON PROJECT-1234 TO GHIJKL

What I want is to search on just the GHIJKL after it extracts or should I just put it at the front so it only fetches that?

[ITWhisperer]

Your sample event doesn't appear to have a comma terminating the user id so perhaps use this rex to extract it?

| rex "User-(?<userid>[^, ]*)"

[richgalloway · Accepted solution]

To search on the resource field, use the where command.

index="xxxx" "role-'WRITE'" OR "role-'READ'"
| rex "User-(?<userid>[^,]*)"
| rex "(?<resource>\w+)$"
| where resource="GHIJKL"
| eval userid=upper(userid)
| stats c as Count latest(_time) as _time by userid