When I test the regex in both regex101 and using the rex command in the search bar and they parsed out the fields correctly. Now that i have added them to the props conf on the search head, they are capturing extra information.
The Result field is the one that is mainly caputuring the SessionID which the the capture is Verified or Failed.
Thank you all for your help with this.
props.conf
[exp_test]
DATETIME_CONFIG =
LINE_BREAKER = ([\r\n]+)
NO_BINARY_CHECK = true
category = Custom
pulldown_type = true
CHECK_FOR_HEADER = false
CHARSET = AUTO
EXTRACT-SessionID = (?<=SessionID:)(?P<SessionID>.+)
EXTRACT-Result = \VerificationResult:(?P<Result>.+)
EXTRACT-UserName = (?<=User:)(?P<UserName>.+)
EXTRACT-Response_1 = (?<=Response_1:)(?P<Response_1>.+)
EXTRACT-Response_2 = (?<=Response_2:)(?P<Response_1>.+)
Sample Log
Time: 13-09-2021 10:08:19
VerificationResult: Failed
SessionID: K3K2N2G3JPSOZNOWJFOMFPBP.pidd1v-210913090809460797217
User: LAST, FIRST
13-09-2021 10:10:18 Response_1: 1st reqest Sent! for User: LAST, FIRST
13-09-2021 10:10:19 Response_1: 1st response received! for User: LAST, FIRST
Time: 13-09-2021 10:10:19
SessionID and User Mapping:
SessionID: 3EV6PLCHK795Z8FQBKKYS3Z3.pidd2v-210913091018537820706
User: LAST, FIRST
13-09-2021 10:15:13 Response_1: 1st reqest Sent! for User: LAST, FIRST
13-09-2021 10:15:14 Response_1: 1st response received! for User: LAST, FIRST
Time: 13-09-2021 10:15:14
SessionID and User Mapping:
SessionID: GAWJ1C7ZWNAWCVTEEIWGE3LL.pidd2v-210913091513558630064
User: LAST, FIRST
13-09-2021 10:15:33 Response_1: 1st reqest Sent! for User: LAST, FIRST
13-09-2021 10:15:33 Response_1: 1st response received! for User: LAST, FIRST
13-09-2021 10:15:38 Response_1: 1st reqest Sent! for User: LAST, FIRST
13-09-2021 10:15:39 Response_1: 1st response received! for User: LAST, FIRST
Time: 13-09-2021 10:15:39
SessionID and User Mapping:
SessionID: 2SYZV3QHCZKYM2YTYIJLVL3E.pidd2v-210913091538460803649
User: LAST, FIRST
13-09-2021 10:15:47 Response_1: 2nd request sent! for the user verification SessionID: 2SYZV3QHCZKYM2YTYIJLVL3E.pidd2v-210913091538460803649
13-09-2021 10:15:48 Response_1: 2nd response received! for user verification SessionID: 2SYZV3QHCZKYM2YTYIJLVL3E.pidd2v-210913091538460803649
Time: 13-09-2021 10:15:48
VerificationResult: Verified
SessionID: 2SYZV3QHCZKYM2YTYIJLVL3E.pidd2v-210913091538460803649
User: LAST, FIRST
13-09-2021 10:16:47 Response_1: 1st reqest Sent! for User: LAST, FIRST
13-09-2021 10:16:48 Response_1: 1st response received! for User: LAST, FIRST
Time: 13-09-2021 10:16:48
SessionID and User Mapping:
SessionID: D5JVVUR3AAKFURITHCI993H9.pidd2v-210913091647448944771
User: LAST, FIRST
