Splunk Search

extracting fields

Jananee_iNautix
Path Finder

Hi,
I have the following log statements
1.Connected to [el2me@star-mf.grgk.com:22]
2.. Connected to [ftpsergr.gregn.com:41]. UserID [egwergrwe]

From the above statements i have to exrtact userid in common.In first log statement e12me is the userid and in second log statement string following the UserID is the userid which i want to extract ie.egwergrwe

i gave the following regex to extract the userid and diplay in table
as
sourcetype="RSBA_LOGS-2" |rex field=_raw "(?:Connected to |UserID)?[(?\S+)(?:@|])" | table userid

But it is not extracting the correct userid .Can anyone help me on the regex.

Tags (1)
0 Karma

somesoni2
Revered Legend

This could be a workaround.

   your base search.. | rex field=_raw "\[(?<userid>[^\]]*)\]$" | rex field=userid "(?<userid>[^@]*)"

No luck so far with single rex.

0 Karma

MuS
Legend

Hi Jananee_iNautix,

try something like this:

(Connected to \[|UserID \[)(?<userid>.+)[\:\]]

here is a good online regex test tool http://www.regexr.com/ where you can test your regex.

hope this helps ...

cheers, MuS

Jananee_iNautix
Path Finder

It is not extracting the userid.Please help...

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...