Splunk Enterprise

Rex field extraction

user93
Communicator

Hello,

I have a simple extraction I need to make on a new dataset that has not yet had the fields defined for me.

I want to extract the user name. The log structure is like so:

time stamp, server info, logstatus, userinfo, result

 

_raw= 2021-05-12 03:58:59,533 [#-####-abcd-#] INFO ServicesLogName#logStatus(): ## - User john.doe@username.com with IP 01.001.01.1 result [successful]

 

In every instance, the username value follows "User" and precedes "with IP" 

 

Index=basesearch application=specified
|rex field=_raw "(?<username>")

 

Thank you! 

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
Index=basesearch application=specified
|rex field=_raw "User\s(?<username>[^\s]+)\swith\sIP"

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
Index=basesearch application=specified
|rex field=_raw "User\s(?<username>[^\s]+)\swith\sIP"
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...