Regex field extraction

[gonzalogasca]

Splunk Version 6.2.0
Splunk Build 237341 (MacOSX Yosemite)

This is the line I'm looking to extract fields using regex:

15:23:42.730 |LogMessage UserID : jdoe ClientAddress : 172.16.60.54 Severity : 3 EventType : UserLogging ResourceAccessed: Cisco CallManager Administration EventStatus : Failure CompulsoryEvent : No AuditCategory : AdministrativeEvent ComponentID : Cisco CCM Application AuditDetails : Failed to Log into Cisco CCM Webpages App ID: Cisco Tomcat Cluster ID: Node ID: UCM-CLI-P

I'm looking to extract:
jdoe
172.16.60.54

I have tested my regex using:
http://www.regexr.com/39t8f
In regexr the information is :

/UserID\s:\s(.*)\s+ClientAddress\s:\s(\d+.\d+.\d+.\d+)\s+\s+(.*)/g

It correctly maps (.*) and (\d+.\d+.\d+.\d+) as group 1 and group 2.

I tested it using Perl:

if ($line
=~m/.*UserID\s:\s(.*)\s+ClientAddress\s:\s(.*)\s+Severity\s:\s+(\d).*/i) {
        print " Username: " . $1 . " ClientAddress: " . $2 .  "\n";         }

And I can correctly get my fields in $1 and $2.

When I execute this search in Splunk:

Failed to Log into Cisco CCM Webpages | rex field=_raw "UserID\s:\s(?.*)\s+ClientAddress\s:\s(?\d+.\d+.\d+.\d+)\s+"

The USERIDINFORMATION and CLIENTADDRESS fields are not extracted. It can find the records because of the left part of the search, but not on my regex.
Any ideas?

[landen99]

The capture fields do need names, but also the regex needs to be good. Anything with ".*" is generally troublesome. You should extract the fields with two seperate regexes for efficiency:

(?i)UserID\s+:\s+(?P<user>\w+)
(?i)ClientAddress\s+:\s+(?P<src>[\.\d]+)

This can be pasted straight into the Field Extractions section of splunk or be set at the commandline:

| rex "(?i)UserID\s+:\s+(?P<user>\w+)" | rex "(?i)ClientAddress\s+:\s+(?P<src>[\.\d]+)"

[gonzalogasca]

For some reason the HTML Formatting was not adding my fields

[Ayn]

I don't see you actually giving your matching groups names? You need to give them names:

rex field=_raw "UserID\s:\s(?<USERIDINFORMATION>.*)\s+ClientAddress\s:\s(?<CLIENTADDRESS>\d+.\d+.\d+.\d+)\s+"