Splunk Search

filter text using rex

nwayoonyanmin
Engager

i can't extract the exact text using rex command . 
e.g


User:  This is my user Name\n  This is just some random text

i want to extract a new filed which values is "This is my user Name"

Labels (2)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

You need 4 slashes in the regex for a single match

View solution in original post

0 Karma

bowesmana
SplunkTrust
SplunkTrust
|rex "User:\"(?<username>[^\"]*)"

will extract from the _raw field starting from the character following the first quote after User: up to the first quote.

0 Karma

nwayoonyanmin
Engager

oh my bad , "" will not exist everytime , the thing for sure and 
will start from ':' and end with '\n' . I try using this | rex field=msg "User:\s(?<user>.+)"
but can't get rid of \n

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Is the \n 2 characters or a line feed?

0 Karma

bowesmana
SplunkTrust
SplunkTrust

If it's a literal \n then 

| rex "User:\s+?(?<username>.*)\\\\n"

If it's a line feed then

| rex "User:\s+?(?<username>.*)\n"
0 Karma

nwayoonyanmin
Engager

i don't know what is wrong i can't get it work 
| rex field=msg "User:\s(?<user>.*)\\\\n" 
this is my query and it doesn't stop at \n

user\n and this text also


0 Karma

nwayoonyanmin
Engager

in my log it's literally "\n" not next line when i extract something it looks like this

user1\n  

but i want only user1 , not \n

0 Karma

bowesmana
SplunkTrust
SplunkTrust

You need 4 slashes in the regex for a single match

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...