CODEWITHSUNDEEP
regexsplunk
Zippy
Zippy

Reputation: 495

Splunk rex extract field, I am close but just cant get it matching

Value session_value contains this info:

not found, name: [email protected] more text here

Trying to use this:

rex field=session_value ":\s(?<USERID>)@"

To extract: user

I think I am close, anyone assist?

Upvotes: 0

Views: 743

Answers (1)

RichG
RichG

Reputation: 9916

You are close, but the most important part is missing. You need to specify what characters match in the capture group. For example,

rex field=session_value ":\s(?<USERID>\w+)@"

Upvotes: 2

Related Questions