another rex question

[packet_hunter]

Scenario, I have a field (msg) below and I need to extract the user id which is user = [abcdefg]

field msg = AAA user accounting Successful : server = 192.168.0.1 : user = abcdefg

index = main | rex field=msg [?] ....

I need the abcdefg portion.
Thank you!

[richgalloway · Accepted solution]

Assuming the value is terminated by a space, this should do the job.

... | rex field=msg "user = (?<user>[^ ]*)" | ...

[packet_hunter]

only getting a single character under stats list(user)

[richgalloway]

I forgot the quantifier (*). Try the updated answer.

[packet_hunter]

Thank you, will have to test later, someone just restarted my indexer....

[packet_hunter]

Sweet!!!! it works great! Thank you