filter text using rex

[nwayoonyanmin]

i can't extract the exact text using rex command . 
e.g

User:  This is my user Name\n  This is just some random text

i want to extract a new filed which values is "This is my user Name"

[bowesmana]

|rex "User:\"(?<username>[^\"]*)"

will extract from the _raw field starting from the character following the first quote after User: up to the first quote.

[nwayoonyanmin]

oh my bad , "" will not exist everytime , the thing for sure and 
will start from ':' and end with '\n' . I try using this | rex field=msg "User:\s(?<user>.+)"
but can't get rid of \n

[bowesmana]

Is the \n 2 characters or a line feed?

[bowesmana]

If it's a literal \n then 

| rex "User:\s+?(?<username>.*)\\\\n"

If it's a line feed then

| rex "User:\s+?(?<username>.*)\n"

[nwayoonyanmin]

i don't know what is wrong i can't get it work 
| rex field=msg "User:\s(?<user>.*)\\\\n" 
this is my query and it doesn't stop at \n

user\n and this text also

[nwayoonyanmin]

in my log it's literally "\n" not next line when i extract something it looks like this

user1\n  

but i want only user1 , not \n

[bowesmana · Accepted solution]

You need 4 slashes in the regex for a single match