topic Re: How to extract from and To fields For this below Line using Regex? in Splunk Enterprise

How to extract from and To fields For this below Line using Regex?

Kumar2 — Wed, 12 Jan 2022 10:06:10 GMT

Info: Bounced: DCID 8413617 MID 19338947 From: <MariaDubois@example.com> To: <abcdef@buttercupgames.com> RID 0 - 5.4.7 - Delivery expired (message too old) ('000', ['timeout'])

O/p:

from_mail_id = MariaDubois@example.com
to_mail_id = abcdef@buttercupgames.com

Please help me with the Solution ,Thanks

Re: How to extract from and To fields For this below Line using Regex?

isoutamo — Wed, 12 Jan 2022 10:12:39 GMT

You could try this (I suppose that you have above data already in splunk _raw field).

... <your search> .. | rex "From: <(?<from_mail_id>[^>]+)> To: <(?<to_mail_id>[^>]+)>"

r. Ismo

Re: How to extract from and To fields For this below Line using Regex?

Kumar2 — Wed, 12 Jan 2022 10:44:44 GMT

Thank you Sir ,But need the Solution using only Regex .

Please help, Thanks in advance

Re: How to extract from and To fields For this below Line using Regex?

isoutamo — Wed, 12 Jan 2022 13:06:24 GMT

if you want to pick those values from events then you need a rex and if you want to select events which contains that kind of parts, but don't want to select those to the new fields then you should use regex.

r. Ismo

Re: How to extract from and To fields For this below Line using Regex?

Kumar2 — Thu, 13 Jan 2022 08:43:19 GMT

Hi @isoutamo sir

How to extract this event into four different counts using rex

1234-5678-9101-1213

example : Count1-1234 count2-5678 and so on.....

please help me with solution, thanks in advance

Re: How to extract from and To fields For this below Line using Regex?

isoutamo — Thu, 13 Jan 2022 09:02:27 GMT

You could use e.g this

... | rex "(?<count-1>\d+)-(?<count-2>\d+)-(?<count-3>\d+)-(?<count-4>\d+)"

You can learn to use rex with regex101.com https://regex101.com/r/ZPQDgg/1