InsightConnect regex to extract second word

Good evening all,

I am creating a workflow in ICON but I have hit a snag with how the pattern matching works. Essentially I am attempting to extract a user out of a line of text gathered from an incident but I am having no luck.

I have been using regex101 and while it looks like it works in there, once I port that across to ICON it either returns more than just that single word, or errors.

In essence I am looking for a regex that will work in the pattern match plugin to say extract just user1 and return that value so I can then use that in log queries etc. Example text here is:

Account user1 was re-enabled by admin1

Any help will be greatly appreciated.

For the Pattern Match step, make sure you use the Golang version of regex101. There are slight differences. Also, check if you need to return an array or a single value.

Hi Brandon, I have been using the Golang version but I still keep returning multiple groups for each indexed word so likely just my lack of experience with regex hence hoping someone had a working example. For now though, I am just using the indexing with the variable but ideally I just want to pull out that single word/user, not index all the words as that is inefficient.

For those who might be interested in the topic, but are not sure how to accomplish what Marten and Brandon are discussing, you can use this to capture. It returns more than one result, but it creates a variable called username with the user1 target that is desired. It creates more than one variable output, but you can then select the variable you defined. I called the variable “Username”.

Test Data




Job Success


Variable Selection


Artifact Input


Artifact Output


Depending on what the data looks like, I would use either of these
For one user

for multiple users


Hey both, apologies for such a delayed response. Highlighted the most appropriate solution provided by Brandon which is much appreciated, that has unlocked a lot of what I was trying to achieve.