For example, for the event log below:
Sep 14 14:10:08 server01 useradd[100009]: add 'user01' to group 'app01'
I'd like to create a single group that would capture add and to group while ignoring the username in between. So the end result would be add to group. I'm trying negative/positive lookaheads/lookbehinds, but no luck so far.
My current solution is to have two capture groups and concatenating them in Splunk. It gets the job done, but just trying to save a step or two wherever I can.