Quantcast
Channel: Latest Questions on Splunk Answers
Viewing all articles
Browse latest Browse all 13053

extracting fields

$
0
0

Hi, I have the following log statements 1.Connected to [el2me@star-mf.grgk.com:22] 2.. Connected to [ftpsergr.gregn.com:41]. UserID [egwergrwe]

From the above statements i have to exrtact userid in common.In first log statement e12me is the userid and in second log statement string following the UserID is the userid which i want to extract ie.egwergrwe

i gave the following regex to extract the userid and diplay in table as sourcetype="RSBA_LOGS-2" |rex field=_raw "(?:Connected to |UserID)?[(?<userid>S+)(?:@|])" | table userid

But it is not extracting the correct userid .Can anyone help me on the regex.


Viewing all articles
Browse latest Browse all 13053

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>