Splunk Search

How to write regex to extract one capture group for user ID?

kmcconnell
Path Finder

I have a regex question that I hope will be easy for someone. I’m not big on regexes so I’m coming to you all for help. I have events where the user account is coming in by itself (xyz123) and sometimes with the domain (domain\xyz123), see below. I was able to just pull out the user IDs with a regex, but it had two capture groups instead of just one [U|u]ser\s(?:[\w\.]+\\(\w+)|([\w]+))\s. I’d like to have one capture group that only has the user ID.

[MsgID: 2]The user domain\xyz123 with source IP address

[MsgID: 2]The user xyz123 with source IP address
Tags (1)
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Try this:

[uU]ser\s(?:[\w.]+\\)?(?<user>\w+)\s

...provided I correctly understand your problem 🙂

View solution in original post

MuS
Legend

Hi kmcconnel,

assuming your ID's are always 6 alphanumeric values and are always before with in the events, try this regex:

(?<myUserID>\w{6})(?=\swith)

hope this helps ...

cheers, MuS

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Try this:

[uU]ser\s(?:[\w.]+\\)?(?<user>\w+)\s

...provided I correctly understand your problem 🙂

kmcconnell
Path Finder

I tried both approaches and they both work, but the answer from martin_mueller was what I had been working toward. Thank you both for the help.

somesoni2
Revered Legend

This works fine after added additional backslash after [\w.]+

MuS
Legend

HeHe, too slow again....

Get Updates on the Splunk Community!

Index This | What did the zero say to the eight?

June 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...