Go Premium for a chance to win a PS4. Enter to Win

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 384
  • Last Modified:

Extracting a username from logs files using Regex

Hi im trying to extract domain usernames from my juniper log files using regex however depending on the log message the fully qualified domain name isnt always displayed

See example below:

line 1:      juniper -ive -] domain/user1(realm) etc. etc.
Line2:      juniper -ive -] user2(realm) etc. etc.

i would like to extract just the username into a group so i'm trying to exclude the word "DOMAIN/" so far i have this:

\]\s(?!DOMAIN\/\b)([a-z_0-9]+)

however it only seems to capture user2

Thanks,
0
kchall
Asked:
kchall
  • 5
  • 4
2 Solutions
 
wdosanjosCommented:
Please try:

(?<=]\s(\w+/)?)\w+(?=\(realm\))
0
 
sdstuberCommented:
'\] (domain//)?([a-z_0-9]+)'

with a back reference of 2,  exact syntax for the back reference will depend on the language/library of the regexp
0
 
kchallAuthor Commented:
Wdosanjos that returned no matches,

I should add im using Rad software Expression Designer to test my regex's

Sdstuber im not sure what you mean, i'm using regex so i can pull out fields in my splunk log analyzer

Thanks,
0
VIDEO: THE CONCERTO CLOUD FOR HEALTHCARE

Modern healthcare requires a modern cloud. View this brief video to understand how the Concerto Cloud for Healthcare can help your organization.

 
wdosanjosCommented:
Here is my test code (C#):
var rx = new Regex(@"(?<=]\s(\w+/)?)\w+(?=\(realm\))");
var tests = new string[]
{
"juniper -ive -] domain/user1(realm)",
"juniper -ive -] user2(realm)"
};

foreach (var test in tests)
{
    rx.Match(test).Value.Dump();
}

Open in new window

Output
user1
user2

Open in new window

0
 
kchallAuthor Commented:
screenshotHi Wdosanjos

when i run that it does in fact match user1 and user2 however i need to group the matches as well.

Also the word "realm" cannot be referenced as this can change as users logon to multiple realms
0
 
wdosanjosCommented:
The expression to address multiple realms is:

(?<=]\s(\w+/)?)\w+(?=\(\w+\))

What do you mean by "group the matches"?  Please give an example.
0
 
kchallAuthor Commented:
Grouping Constructs using the ( and ) symbols
IE. if i wanted to just capture domain/user1 and user2 i would use \]\s([a-z0-9\/]+)
0
 
wdosanjosCommented:
Checking the ExplicitCapture option should resolve the grouping issue.
0
 
kchallAuthor Commented:
Sorry Wdosanjos i couldnt get your string to work. In the end i used the following

\]\s(?:DOMAIN\\*)?(.\w+)

Thanks anyways
0
 
kchallAuthor Commented:
huh!
0

Featured Post

Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

  • 5
  • 4
Tackle projects and never again get stuck behind a technical roadblock.
Join Now