I have been working with extracting userIDs using RegExs and have run into some trouble. The following returns the correct results
| rex field=_raw "\,[abc]\w\w\w\w\w\w(?<userID>)" | stats count(userID)
This extracts user IDs from a csv file (that is our sourcetype)
When I go to the Fields Extraction page and edit the extraction manually, I don't get any results (actually, it returns none found)
I have tried editing the inline regex to read \,[abc]\w\w\w\w\w\w(?
There may be some editing error, your
userID capturing group cannot match anything because it's empty.
Thanks for the responses. I have a csv with information like email, userID, phone number, etc in it. A typical userID will be formatted like 'acb1234'. The issue that I am addressing is that the userID location between the various sourcetypes has changed over time. Meaning that in version one, the userID was in the second column, in version two, is has moved to the 8th column.
Thank you! Mike
| rex "(,\s)* (?P<userID>\w\w\w\d\d\d\d)(,\s)*"
assumming userId format is 3 alphabet and 4 digits. Update this if necessary.