Trouble creating a new field

[gforster]

2017-06-06 08:30:56,761 [ajp-127.0.0.4-8009-44] INFO  Weblogger  - 3B08FDCAF216658E81536A07B9D5772E: cdbarnes: reset randomusername LDAP password. ticket: 3121467

Given the above line from a log, I need to have a field for "randomusername." The goal would then be to plot it on a timechart so that it can readily be discerned how many times a given user changes their password within a timeframe. I'm not sure of the best approach to isolate the username and make it its own field to begin with.

thanks

[niketn]

You can begin using rex command, one example is below

<Your Base Search>
| rex field=_raw "reset (?<UserName>.+) LDAP password"
| table UserName _raw

However, you should ideally perform the same using Interactive Field Extraction (IFX) through the Extract New Fields option through your Splunk Search screen. Refer to the documentation for Step By Step process. Two advantages would be
1) Splunk will generate/adjust regular expression based on your data/needs
2) Fields will persist as Knowledge Object hence can be reused.
3) You can override with your own regular expression.

http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/ExtractfieldsinteractivelywithIFX

[adonio]

use the field extractor
http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/ExtractfieldsinteractivelywithIFX
hope it helps