Splunk Search

Rex to extract string with words and characters

AK89
Explorer

Looking for help with this rex command. I want to capture the continuous string after "invalid user" whether it has special characters or not. Here are some examples from my data set (abc is just an example, it could be any word or character) 

  • invalid user abc
  • invalid user abc@def
  • invalid user $abc
  • invalid user abc\def
  • invalid user abc-def

If I run the below, I am able to successfully extract the invaliduser if it is a word. But this does not work if there is a special character

base search | rex "invalid user (?<invaliduser>\w+) "

I have figured out how to extract if there is a leading special character (W+\w+) or a special character in the middle (w+\W+\w+) but those aren't exactly what I'm looking for.

Is there a single rex command I can use to capture all possible results? 

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

If the string ends with a space then you can extract it using this command

| rex "invalid user (?<invaliduser>\S+)"

 

If it ends with a comma or other character not part of the string then this command should do it

| rex "invalid user (?<invaliduser>[^,]+)"
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

If the string ends with a space then you can extract it using this command

| rex "invalid user (?<invaliduser>\S+)"

 

If it ends with a comma or other character not part of the string then this command should do it

| rex "invalid user (?<invaliduser>[^,]+)"
---
If this reply helps you, Karma would be appreciated.

AK89
Explorer

That's exactly what I needed. Thanks for the help!

inventsekar
Ultra Champion

Dear Splunk new learners... 
https://www.youtube.com/@siemnewbies101/playlists

the primary objective of this youtube channel is to teach Splunk newbies / new learners the SPL commands and most importantly the regular expressions. pls check it out, thanks. 

0 Karma
Get Updates on the Splunk Community!

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...