Simple Regex in search

[balcv]

I have a string of data that includes a field named user that has a value made up of domain\userid (eg prod\3245762 or tst\3245762 tst\smith) . I am wanting to write a search that can pull data based on a wildcard for the domain then only detect userid starting with 3,4 or 5).
I've tried index=* | rex field=user("*\\[3-5]*")
and various versions of. The majority return errors such as "...... is invalid", "Error in Search Operator:regex"

Can anyone shed some light on an appropriately formatted regex or rex statement please.

[paranjith]

Try this:

index=* | rex field=user "(?P<domain>^.*)\\(?P<userid>[3-5].*$)"

This regex retrieves only the domain\userid where userid starts with either 3, 4 or 5 and any value for domain.

Hope this helps!!!

[vinod94]

Hi @balcv ,

Do you want something like this ....

Your search |  rex field=user "(?P<domain>.*)\\\\(?P<userid>.*)" 
| rex field=userid "(?P<userid_startingwith_3or5>3.+|5.+)"

this is a run anywhere search

| makeresults 
| eval user="prod\3245762;tst\3245762;tst\smith" 
| makemv delim=";" user 
| mvexpand user  | fields - _time 
| rex field=user "(?P<domain>.*)\\\\(?P<userid>.*)" 
| rex field=userid "(?P<userid_startingwith_3or5>3.+|5.+)"

[vnravikumar · Accepted solution]

Hi @balcv

Try this

| makeresults 
| eval user="prod\3245762;tst\3245762;tst\smith" 
| makemv delim=";" user 
| mvexpand user  | regex user="(.*)\\\([3-5][0-9]*$)"

[vnravikumar]

@balcv, resolved?

[balcv]

Thanks for your help. All good now.

[chrisyounger]

Try this: index=* | rex "\\(?<username>[3-5]\w+)"

All the best

[balcv]

Still giving me the following error:

Error in 'rex' command: Encountered the following error while compiling the regex '*\(?<username>[3-5]\w+)': Regex: quantifier does not follow a repeatable item

What I though I was needing would be \ for the domain wildcard, then anything **starting* with 3,4 or 5 which could contain up to 7 or 8 characters. (eg tst\326541 or prod\456987)

So something along the lines of rex field=user "*\\([3-5]*")

[chrisyounger]

Try my latest one that I edited in: index=* | rex "\\(?<username>[3-5]\w+)"

[chrisyounger]

You can also try something more restrictive like this: index=* | rex "(?:prod|tst)\\(?<username>[3-5]\w+)"