What is the most efficient way to extract user name from my sample Message fields?

[smudge797]

What's the most efficient way to extract the user name from these messages:

Message=Self-service Plug-in started (user=DOMAINX\a123456)
Message=Self-service Plug-in started (user=DOMAINY\c123456)

Thanks

[ddrillic]

\\(?<user>(\w|\d+)*) should do it...

[smudge797]

Error in 'rex' command: Encountered the following error while compiling the regex '(?(\w|\d+)*)': Regex: unmatched parentheses

[ddrillic]

right ; -)

| rex  field=data "\\\(?<user>(\w|\d)*)"

three slashes - the editors mistreat them ....

[woodcock · Accepted solution]

Like this:

... | rex field=Message "\(user=(?<user>[^\)]+)"

[smudge797]

Nice,

user="DOMAINY\L123456"
Can we drop the domain or separate it?

[woodcock]

Like this:

 ... | rex field=Message "\(user=(?<domain>[^\\\]+)\\\(?<user>[^\)]+)"

[smudge797]

Nice thanks!

[ppablo]

Hi @smudge797

Glad you found a solution through @woodcock and gave him an upvote, but please don't forget to click "Accept" directly below his answer to resolve the question. Thanks!

[smudge797]

Done!

Thanks.

[richgalloway]

I'm not sure if it's the most efficient, but it's one of the simplest.

... | rex field=Message "\\(?<userName>[^\)]*)" | ...

[richgalloway]

The leading backslash needs to be escaped. Otherwise, it escapes the left paren.

[smudge797]

Error in 'rex' command: Encountered the following error while compiling the regex '\(?[^\)]*)': Regex: unmatched parentheses

[jmallorquin]

Hi,

props.conf

[<<sourcetype>>>]
.
.
.

    EXTRACT-user = \\(?<user_wo_domain>[^\)]+)\)$

Hope i help you