Splunk Search

extract module name (till colon)

indeed_2000
Builder
Hi
regex for extract module name 
 
here is the log:
15:25:36.999 user module_W: A[00]B[0000000]C[0]L: process read compeleted!
the module name is "module_W" after user "start  with star wildcard till colon"
 
Any idea?
Thanks,
 
Labels (6)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| rex "^\S+\s\S+\s(?<module>[^:]+)"

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| rex "user (?<module>[^:]+)"

indeed_2000
Builder

thank you for answer, user is not static value are different for users, is it possible to set (variable user after that space) for first part? 

FYI: there are some special character in users

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| rex "^\S+\s\S+\s(?<module>[^:]+)"

View solution in original post

Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!