Reg - How do I extract username?

[Sasti]

Hi All,

     I'm trying to extract the username from the _raw field using regex, how do I extract the username. The username comes after some parameters, the parameters look like (\"requestParameters\": {\"userName\": <username>)

[gcusello · Accepted solution]

Hi @Sasti,

this log seems to be a json, did you tried to use the "INDEXED_EXTRACTIONS = JSON" option in props.conf?

or did you tried to use the "spath" command in search?

Anyway, if you want to use a regex, lete me understand, does you log contain? 

\"requestParameters\": {\"userName\": <username>

or 

"requestParameters": {"userName": <username>

in other words: in your logs are there slashes before quotes or not?

if yes, you could use a regex like this:

| rex "\\\"requestParameters\\\": \{\\\"userName\\\": \<(?<username>[^\>]*)"

if it doesn't run, please try this:

| rex "\\\\"requestParameters\\\\": \{\\\\"userName\\\\": \<(?<username>[^\>]*)"

If instead you don't have backslashes before quotes (as I suppose), please try this:

| rex "\"requestParameters\": \{\"userName\": \<(?<username>[^\>]*)"

If you could share a full logs I could be more sure

Ciao.

Giuseppe

[Sasti]

Hi @gcusello 

        Thanks dude,  now I can able to extract the username. let's have fun and enjoy.

[gcusello]

Hi @Sasti,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the Contributors 😉

[Sasti]

Yeah, the log is JSON type, Thanks for your support I'll try this out with your examples and let you know if those work, or else I'll try to send the full logs.

[PickleRick]

What have you tried so far and what's the result?

[Sasti]

So I tried some regex likes(rex field=_raw "requestParameters\:(?P<userName>(.*))\=", rex field=_raw "requestParameters\: userName:\s(?<user>[^\/]+)", rex field=_raw "requestParameters":\s{\"userName"\:[a-zA-Z]+(?=+(?:"}" ) and the result is nothing it's not fetching the username.