I'm trying to use the Extract fields wizard to pull a field out of a log, but running into an issue. Here a portion of an example log.
username1 (WT_AD/RSA) [Webtop I,Webtop III] - 2017/03/14 15:09:57
What I'm interested in is the value in [ ] which is the user's "Role". The problem I have is, that value may be a single value (ie. [Webtop I] ), or possibly multiple values separated by commas. In this example, the user has been assigned 2 "Roles", "Webtop I" and "Webtop III". I was able to get everything inside the [ ] to appear as a single field (i.e. Role="Webtop I, Webtop III"), but I'd like to be able to extract them each as a value (ie. Role="Webtop I" AND Role="Webtop III". This way when I search for Role="Webtop I", I get results when a user was assigned multiple roles as well.
I'm not very good with Regular Expressions, but here is what is working with them as a single value.
^[^)\n]*)[(?P[^]]+)
Any help would be appreciated. Thanks in advance.
... View more