Splunk Search

extracting fields

I have the following log statements
1.Connected to [el2me@star-mf.grgk.com:22]
2.. Connected to [ftpsergr.gregn.com:41]. UserID [egwergrwe]

From the above statements i have to exrtact userid in common.In first log statement e12me is the userid and in second log statement string following the UserID is the userid which i want to extract ie.egwergrwe

i gave the following regex to extract the userid and diplay in table
sourcetype="RSBA_LOGS-2" |rex field=_raw "(?:Connected to |UserID)?[(?\S+)(?:@|])" | table userid

But it is not extracting the correct userid .Can anyone help me on the regex.

Tags (1)
0 Karma

Revered Legend

This could be a workaround.

   your base search.. | rex field=_raw "\[(?<userid>[^\]]*)\]$" | rex field=userid "(?<userid>[^@]*)"

No luck so far with single rex.

0 Karma


Hi Jananee_iNautix,

try something like this:

(Connected to \[|UserID \[)(?<userid>.+)[\:\]]

here is a good online regex test tool http://www.regexr.com/ where you can test your regex.

hope this helps ...

cheers, MuS

It is not extracting the userid.Please help...

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!