I have VPN access connect/disconnect events from a Meraki security appliance being fed into Splunk. They show up in Splunk as: Jun 2 11:13:37 10.0.0.253 1 1401722017.518634469 Site1_Firewall events client_vpn_connect user id 'username@domainname.com' local ip 192.168.111.165 connected from 10.2.30.44 Jun 2 11:10:02 10.0.0.253 1 1401721802.723896809 Site1_Firewall events client_vpn_disconnect user id 'username@domainname.com' local ip 192.168.111.165 connected from 10.2.30.44 I am needing this data to be less cluttered for a report that shows when users are accessing the VPN, and would only really need something like: Jun 2 11:10:02 connect username@domainname.com 10.2.30.44 Jun 2 11:13:55 disconnect username@domainname.com 10.2.30.44 What would be the best method of extracting only the needed information from the logged message? I have read up on the rex command in splunk and while it seems like this would be where I need to be looking, I have absolutely no experience with how to write regular expressions. If anyone can offer a suggestion on how to accomplish this (as well as tips/reading material for understanding and writing regular expressions!) I would be very appreciative ... View more