Splunk Search

rex to export users

indeed_2000
Motivator

Hi
what is the spl command to extract users.

Here is the sample:
2021-09-12 21:40:03,938 ERROR [APPNAME] User H83952 invalid: javax.security.auth.login.LoginException:
2021-09-12 21:40:03,938 ERROR [APPNAME] User 83944 invalid: javax.security.auth.login.LoginException:
2021-09-12 21:40:03,938 ERROR [APPNAME] User A_Frok invalid: javax.security.auth.login.LoginException:

expected output:
H83952
83944
A_Frok

Thanks,

0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust

Hi

e.g. this works

...
| rex "User (?<user>[^\s]+)"

r. Ismo 

View solution in original post

isoutamo
SplunkTrust
SplunkTrust

Hi

e.g. this works

...
| rex "User (?<user>[^\s]+)"

r. Ismo 

Get Updates on the Splunk Community!

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer at Splunk .conf24 ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...