REGEX for authentication logs

[hartfoml]

I have authentication logs like below:

,AUTHN_METHOD_FOO,123!@#123!@#123!@#asdfgdvfd,123!@#123!@#123!@#asdfgdvfd,123!@#123!@#123!@#asdfgdvfd,123!@#123!@#123!@#asdfgdvfd,username,FIRST,LAST,

I want to use regex to build transform for a field called username and first and last

I had this but it didn't work

rex "(?i)AUTHN_METHOD_*+,*+,*+,*+,*+,(?P<username>[^,]+)"

Any help would be great!!!

[somesoni2 · Accepted solution]

Try this

rex "(?i)AUTHN_METHOD_\w+,.*,(?<username>[^,]+),(?<first>[^,]+),(?<last>[^,]+)"

[hartfoml]

Thanks, I have a problem becasue the \w+ could be one work or several like this "SUCCESS_TEMPORARY_FIXED_TOKENCODE" and the .* for the 4 sets of guid numbers seems odd