rex extraction

[a212830]

Hi,

I'm trying to extract a field via rex for a search and having problems. Hoping someone could help me...

Here's some sample data - I want to get the "user" field, which is the "a" plus the 6 digits. I had rex "(?i)/.*?/(?P<FIELDNAME>[a-f0-9]+)(?=@)", but that didn't work.

2014-01-09T10:35:27.671644-05:00 hosta Juniper: 2014-01-09 10:35:27 - ive - [1.2.3.4] a123456(Mobile Web Cert)[Mobile] - Network Connect: Session started for user with IP 67.68.1.2, hostname a123456s-iPad

2014-01-09T10:34:40.618589-05:00 hosta Juniper: 2014-01-09 10:34:40 - ive - [7.8.9.0] a987654 JOE SCHMOE(Web Cert)[Full Access] - Network Connect: Session started for user with IP 1.2.3.4, hostname BLAH

[arihant16cse]

please check it .it is efficent respect to all possibilties.

[lukejadamec]

Try something like this:

search |rex ".*(?P<userID>[a]\d{6})"

[kristian_kolb · Accepted solution]

I would suggest;

... | rex "\]\s(?<user>a\d{6})"

/k