topic Re: Regex to extract email domain name in Splunk Search

Regex to extract email domain name

davidcraven02 — Wed, 21 Mar 2018 15:24:02 GMT

I have two regexes below which are pulling the domain name of the email sender (from). i.e linkedin.com, amazones.com.

However I cant create one regex to pull them both in one as they aren't always in the same format.

index=fortimail source=/var/log/messages/splunk/fortimail/*-fortimail.log 
| dedup   date, time, to, from, domain, subject
| rex field=from "(.*@.*\.(?<domainname>.*\..*)$)"
| rex field=from ".*@(?<domainname2>.*\..*)$" 
| table date, time, to, from, domainname, domainname2, subject, message_length

Re: Regex to extract email domain name

BearMormont — Wed, 21 Mar 2018 15:43:20 GMT

This should work with any domain (not just .com):

rex field=from ".*?(?<domainname>[\w]+\.[\w]+)$"

Edit:
Example - https://regex101.com/r/1uTWmD/1/

Re: Regex to extract email domain name

davidcraven02 — Wed, 21 Mar 2018 16:22:26 GMT

It doesn't work with this example: firstname.surname@test.co.uk

Any thoughts?

Re: Regex to extract email domain name

tiagofbmm — Wed, 21 Mar 2018 16:40:15 GMT

Try this generic example

| makeresults 
| eval to="tiago@lalala.domain1.com" 
| append [ | makeresults 
| eval to="tiago@domain2.com" ]
| append [ | makeresults | eval to="firstname.surname@test.co.uk" ]
| rex field=to "@(.*\.)*(?<Domain>.*\..*)"

The test.co.uk is an outlier to this rule? Did you want domain to be test.co.uk? Then you have the same exact format but you want two different behaviours?

Regex doesn't work like that

Re: Regex to extract email domain name

elliotproebstel — Wed, 21 Mar 2018 17:13:48 GMT

This is a generically difficult problem. Differentiating domains from subdomains requires a priori knowledge of all top level domains (TLDs), because a domain is really just something.valid-tld, where something is composed of letters, numbers, and hyphens (if the hyphens are surrounded on both sides by letters, numbers, or other hypens; hyphens may not be the first or last character in a domain name).

To that end, you could build something yourself that does this, but you'd be reinventing the wheel. You might want to check out this blog post on UT_parsing, which describes a few Splunk add-ons/apps that you could leverage in your work.

Re: Regex to extract email domain name

davidcraven02 — Wed, 21 Mar 2018 17:16:12 GMT

Thank you! Yes i thought I was maybe over complicating it.