topic Re: How to create a regex domain to not include "@" and terminate capture before ">"? in Splunk Search

How to create a regex domain to not include "@" and terminate capture before ">"?

Log_wrangler — Thu, 28 Jun 2018 14:10:58 GMT

Hi,
I have been tinkering with regex101 for some time now and no luck.

I have a field called sender

Return-Path:<someName@someDomain.com>
Return-Path:<someName@someDomain.com.blah>

I want to regex the sender so that I get

someDomain.com
someDomain.com.blah

So I want the string to start after @ and end before >

here is what I started with

... | rex field=sender "@(?<domain>.*)"

Thank you

Re: How to create a regex domain to not include "@" and terminate capture before ">"?

FrankVl — Thu, 28 Jun 2018 14:21:45 GMT

Close, try this:

| rex field=sender "@(?<domain>[^\>]+)"

You want to read only characters not equal to >. https://regex101.com/r/WbsXgT/1

Re: How to create a regex domain to not include "@" and terminate capture before ">"?

Log_wrangler — Thu, 28 Jun 2018 14:24:17 GMT

"@(?<domain>.*)>"

Re: How to create a regex domain to not include "@" and terminate capture before ">"?

jodyfsu — Thu, 28 Jun 2018 14:25:27 GMT

Try this:

| rex field=sender "@(?<domain>.[^\>]+)"

Re: How to create a regex domain to not include "@" and terminate capture before ">"?

ddrillic — Thu, 28 Jun 2018 14:26:14 GMT

Just add the >, such as - ... | rex field=sender "@(?<domain>.*)>"

Re: How to create a regex domain to not include "@" and terminate capture before ">"?

jkat54 — Thu, 28 Jun 2018 14:39:37 GMT

I like this approach myself

 (?<=@)(?<domainName>.*)(?=>)

Re: How to create a regex domain to not include "@" and terminate capture before ">"?

FrankVl — Thu, 28 Jun 2018 14:48:50 GMT

Any reason for why you like that approach? It is harder to read and if I interpret the regex101 execution info correctly a lot less efficient than a straightforward "@(?<domain>.[^\>]+)".

Given the 2 line sample from the question, regex101 reports 13 steps for my solution and 125 steps for yours.

Re: How to create a regex domain to not include "@" and terminate capture before ">"?

jkat54 — Thu, 28 Jun 2018 15:08:18 GMT

Oh it’s less efficient for sure. I like it because it opens the user’s eyes to reverse and forward lookups etc.

Re: How to create a regex domain to not include "@" and terminate capture before ">"?

Log_wrangler — Thu, 05 Jul 2018 15:11:23 GMT

thanks, I will check it out