Splunk Search

rex command help

kumar518g
Explorer

hi ,
i have extracted a field using IFX but from the list of values like mentioned below ,need to remove userID = text so please help me how to write rex for this.
UserID =SVORMA8
UserID =SVORMA1
etc

Regards
Ravi

Tags (2)
0 Karma

piebob
Splunk Employee
Splunk Employee

Ravi, please try and do some of your own homework before asking people here to do your job for you. as described in the documentation, the rex command uses Perl regular expressions (regex). if you do not understand how to write a regex, you should learn. here are some resources: http://www.regexbuddy.com/

Get Updates on the Splunk Community!

Cultivate Your Career Growth with Fresh Splunk Training

Growth doesn’t just happen—it’s nurtured. Like tending a garden, developing your Splunk skills takes the right ...

Introducing a Smarter Way to Discover Apps on Splunkbase

We’re excited to announce the launch of a foundational enhancement to Splunkbase: App Tiering.  Because we’ve ...

How to Send Splunk Observability Alerts to Webex teams in Minutes

As a Developer Evangelist at Splunk, my team and I are constantly tinkering with technology to explore its ...