How to use rex to remove the domain from the "User name" field and use the username only as a named extraction?

[kris99]

How do I use regex within search to remove the domain from the field "User name" and use the username only as named extraction.

domain\username

something like this i think but don't know who to write regex to extract username or extract everything after "\" from field "User name"

| rex field="User name" "" | eval UserName=lower(UserName) | where UserName=lower(UserName) | search UserName="*"

[richgalloway · Accepted solution]

Try this:

... | rex field="User name" "(?<domain>\S+)\\\\(?<userName>\S+)" | eval userName=lower(userName) | ...

If Splunk doesn't like a field name with a space in it, try this:

... | eval domainUsername="User name" | rex field=domainUsername "(?<domain>\S+)\\\\(?<userName>\S+)" | eval userName=lower(userName) | ...

[richgalloway]

Please accept the answer.

[kris99]

yes i did.

just so i learn how to write regex, if it was seperated by : what would i replace it with ?

[richgalloway]

In the regex in the answer, the four backslashes are the separator between the domain and username. If the separator becomes ':' then the regex becomes "(?\S+):(?\S+)".

A good way to learn is through experimentation. Try regexr.

[richgalloway]

The escape character needs to be escaped. I've updated the answer.

[kris99]

works like a charm.. thank you !

[richgalloway]

What do you get?

[kris99]

same error above

[richgalloway]

The backslash needs to be escaped.

[kris99]

only using this.. no luck

rex field=domainUsername "(?<domain>\S+)\\(?<userName>\S+)" 

[richgalloway]

The parts between < and > define a Splunk field into which rex will extract matches. They're not placeholders. Change "domain-22" back to "domain" and it should work.

[kris99]

still getting same error. tried both options above

Error in 'rex' command: Encountered the following error while compiling the regex '(?<domain>\S+)\(?<userName>\S+)': Regex: unmatched parentheses 

[kris99]

getting an error as below. domain includes domain-22\username

Error in 'rex' command: Encountered the following error while compiling the regex '(?<domain-22>\S+)\(?<userName>\S+)': Regex: unmatched parentheses 

[richgalloway]

Just what? If there's a character between the quotation marks, it's not showing up. Escape the character or use backtics.

[kris99]

editor is removing backward slash

[kris99]

 domain\username

[richgalloway]

What separates domain from username? Please share a sample of your data.

[kris99]

just "\"

"User name"=domain\username