I'm trying to extract a field via rex for a search and having problems. Hoping someone could help me...
Here's some sample data - I want to get the "user" field, which is the "a" plus the 6 digits. I had
rex "(?i)/.*?/(?P<FIELDNAME>[a-f0-9]+)(?=@)", but that didn't work.
2014-01-09T10:35:27.671644-05:00 hosta Juniper: 2014-01-09 10:35:27 - ive - [18.104.22.168] a123456(Mobile Web Cert)[Mobile] - Network Connect: Session started for user with IP 22.214.171.124, hostname a123456s-iPad
2014-01-09T10:34:40.618589-05:00 hosta Juniper: 2014-01-09 10:34:40 - ive - [126.96.36.199] a987654 JOE SCHMOE(Web Cert)[Full Access] - Network Connect: Session started for user with IP 188.8.131.52, hostname BLAH