extracting fields

[Jananee_iNautix]

Hi,
I have the following log statements
1.Connected to [[email protected]:22]
2.. Connected to [ftpsergr.gregn.com:41]. UserID [egwergrwe]

From the above statements i have to exrtact userid in common.In first log statement e12me is the userid and in second log statement string following the UserID is the userid which i want to extract ie.egwergrwe

i gave the following regex to extract the userid and diplay in table
as
sourcetype="RSBA_LOGS-2" |rex field=_raw "(?:Connected to |UserID)?[(?\S+)(?:@|])" | table userid

But it is not extracting the correct userid .Can anyone help me on the regex.

[somesoni2]

This could be a workaround.

   your base search.. | rex field=_raw "\[(?<userid>[^\]]*)\]$" | rex field=userid "(?<userid>[^@]*)"

No luck so far with single rex.

[MuS]

Hi Jananee_iNautix,

try something like this:

(Connected to \[|UserID \[)(?<userid>.+)[\:\]]

here is a good online regex test tool http://www.regexr.com/ where you can test your regex.

hope this helps ...

cheers, MuS

[Jananee_iNautix]

It is not extracting the userid.Please help...