I have been working with extracting userIDs using RegExs and have run into some trouble. The following returns the correct results
| rex field=_raw "\,[abc]\w\w\w\w\w\w(?<userID>)" | stats count(userID)
This extracts user IDs from a csv file (that is our sourcetype)
When I go to the Fields Extraction page and edit the extraction manually, I don't get any results (actually, it returns none found)
I have tried editing the inline regex to read \,[abc]\w\w\w\w\w\w(?
Thanks for the responses. I have a csv with information like email, userID, phone number, etc in it. A typical userID will be formatted like 'acb1234'. The issue that I am addressing is that the userID location between the various sourcetypes has changed over time. Meaning that in version one, the userID was in the second column, in version two, is has moved to the 8th column.
Thank you! Mike