The question doesn't seem to be related to dates - unless you can show two different raw events, one for which your regex works as desired, one for which not. Additionally, unless you can demonstrate your regex, there is no way to diagnose. But ultimately, what is the significance of this string preceding the bracketed date, namely "Brew Bar John Doe_123456_UE"? According to your description, the value you want is "Brew Bar John Doe". If your description is accurate, this is the value of CN attribute in that embedded LDAP node, except that embedded message contains a nonstandard delimiter ("+" instead of space), and some inconvenient spacing, both can be fixed easily. Instead of trying to reinvent regex, I suggest that you use Splunk supported extractions when applicable. They are more robust. In your case, the log contains a segment that is NCSA/Apache access log. Splunk comes with access-request and access-extractions for such. For example, | rex mode=sed "s/\+/,/g s/= */=/g" ``` handle little quirks in data ```
| extract access-request ``` but this is robust ``` This will give you C CN O OU file ink method root uri uri_domain uri_path uri_query version us Brew Bar John Doe Brew Bar Joint 123456 BROk305031.xml 202305031525554263206 GET rest /rest/BROk305031.xml?ink=202305031525554263206 /rest/BROk305031.xml ink=202305031525554263206 HTTP/1.1 Alternatively, you can use | rex mode=sed "s/\+/,/g s/= */=/g"
| extract access-extractions C CN O OU ink us Brew Bar John Doe Brew Bar Joint 123456 202305031525554263206
... View more
