Splunk Search

filter text using rex

nwayoonyanmin
Engager

i can't extract the exact text using rex command . 
e.g


User:  This is my user Name\n  This is just some random text

i want to extract a new filed which values is "This is my user Name"

Labels (2)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

You need 4 slashes in the regex for a single match

View solution in original post

0 Karma

bowesmana
SplunkTrust
SplunkTrust
|rex "User:\"(?<username>[^\"]*)"

will extract from the _raw field starting from the character following the first quote after User: up to the first quote.

0 Karma

nwayoonyanmin
Engager

oh my bad , "" will not exist everytime , the thing for sure and 
will start from ':' and end with '\n' . I try using this | rex field=msg "User:\s(?<user>.+)"
but can't get rid of \n

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Is the \n 2 characters or a line feed?

0 Karma

bowesmana
SplunkTrust
SplunkTrust

If it's a literal \n then 

| rex "User:\s+?(?<username>.*)\\\\n"

If it's a line feed then

| rex "User:\s+?(?<username>.*)\n"
0 Karma

nwayoonyanmin
Engager

i don't know what is wrong i can't get it work 
| rex field=msg "User:\s(?<user>.*)\\\\n" 
this is my query and it doesn't stop at \n

user\n and this text also


0 Karma

nwayoonyanmin
Engager

in my log it's literally "\n" not next line when i extract something it looks like this

user1\n  

but i want only user1 , not \n

0 Karma

bowesmana
SplunkTrust
SplunkTrust

You need 4 slashes in the regex for a single match

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...