Splunk Search
Highlighted

another rex question

Contributor

Scenario, I have a field (msg) below and I need to extract the user id which is user = [abcdefg]

field msg = AAA user accounting Successful : server = 192.168.0.1 : user = abcdefg

index = main | rex field=msg [?] ....

I need the abcdefg portion.
Thank you!

Tags (1)
0 Karma
Highlighted

Re: another rex question

SplunkTrust
SplunkTrust

Assuming the value is terminated by a space, this should do the job.

... | rex field=msg "user = (?<user>[^ ]*)" | ...
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

Highlighted

Re: another rex question

Contributor

only getting a single character under stats list(user)

0 Karma
Highlighted

Re: another rex question

SplunkTrust
SplunkTrust

I forgot the quantifier (*). Try the updated answer.

---
If this reply helps you, an upvote would be appreciated.
0 Karma
Highlighted

Re: another rex question

Contributor

Thank you, will have to test later, someone just restarted my indexer....

0 Karma
Highlighted

Re: another rex question

Contributor

Sweet!!!! it works great! Thank you

0 Karma