I have a simple extraction I need to make on a new dataset that has not yet had the fields defined for me.
I want to extract the user name. The log structure is like so:
time stamp, server info, logstatus, userinfo, result
_raw= 2021-05-12 03:58:59,533 [#-####-abcd-#] INFO ServicesLogName#logStatus(): ## - User firstname.lastname@example.org with IP 01.001.01.1 result [successful]
In every instance, the username value follows "User" and precedes "with IP"
Index=basesearch application=specified|rex field=_raw "(?<username>")
|rex field=_raw "User\s(?<username>[^\s]+)\swith\sIP"
View solution in original post