Answer by warren for Regex working on regex101 and not on Splunk

This will do it, based on your sample data:

(?<username>[a-z0-9A-Z\-\_\.\w]+)(\s?)+$

There are probably more efficient formulations. If you don’t have spaces at the end of the line, you can use this:

(?<username>[a-z0-9A-Z\-\_\.]+)$

from User warren – Stack Overflow https://stackoverflow.com/questions/56115480/regex-working-on-regex101-and-not-on-splunk/73129494#73129494
via IFTTT