Please enable JavaScript to use regex101
/
^
r
e
g
e
x
[
\
-
_
]
?
1
0
1
$
/
i
Reg
ular
Ex
pressions
101
Upgrade to Pro
Enterprise
Regular Expression
/
USER \((\w+)\)$
/
gm
Input 1
New
Jul 6 14:01:23 computer.name CRON[29440]: USER (good_user) show_time_of_pid("Jul 6 14:02:08 computer.name jam_tag=psim[29187]: (UUID:006) Jul 6 14:02:09 computer.name jam_tag=psim[29187]: (UUID:007) Jul 6 14:03:01 computer.name CRON[29440]: USER (naughty_user) Jul 6 14:03:40 computer.name cacheclient[29807]: start syncing from \"0xDEADBEEF\" Jul 6 14:04:01 computer.name CRON[29440]: USER (naughty_user) Jul 6 14:05:01 computer.name CRON[29440]: USER (naughty_user)