Splunk Search

filter text using rex

nwayoonyanmin
Engager

i can't extract the exact text using rex command . 
e.g


User:  This is my user Name\n  This is just some random text

i want to extract a new filed which values is "This is my user Name"

Labels (2)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

You need 4 slashes in the regex for a single match

View solution in original post

0 Karma

bowesmana
SplunkTrust
SplunkTrust
|rex "User:\"(?<username>[^\"]*)"

will extract from the _raw field starting from the character following the first quote after User: up to the first quote.

0 Karma

nwayoonyanmin
Engager

oh my bad , "" will not exist everytime , the thing for sure and 
will start from ':' and end with '\n' . I try using this | rex field=msg "User:\s(?<user>.+)"
but can't get rid of \n

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Is the \n 2 characters or a line feed?

0 Karma

bowesmana
SplunkTrust
SplunkTrust

If it's a literal \n then 

| rex "User:\s+?(?<username>.*)\\\\n"

If it's a line feed then

| rex "User:\s+?(?<username>.*)\n"
0 Karma

nwayoonyanmin
Engager

i don't know what is wrong i can't get it work 
| rex field=msg "User:\s(?<user>.*)\\\\n" 
this is my query and it doesn't stop at \n

user\n and this text also


0 Karma

nwayoonyanmin
Engager

in my log it's literally "\n" not next line when i extract something it looks like this

user1\n  

but i want only user1 , not \n

0 Karma

bowesmana
SplunkTrust
SplunkTrust

You need 4 slashes in the regex for a single match

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...