topic Re: how to extract a string before the @ symbol from an email adress? in Splunk Search

how to extract a string before the @ symbol from an email adress?

pavanae — Mon, 10 Feb 2020 16:19:14 GMT

I have the username filed extraction as follows in the props.conf which extracts the email address:-

 [sourcetype_X]
 EXTRACT-XYZ = username="(?<user>[^+\"]*)"

which extracts the field as follows

 x12345@abc-def-ghij-01.com
 y67891@klm-def-ghij-01.com
 z45787@abc-def-ghij-01.com
 ABC-DEF

Now what would be regex stanza to extract the username as follows from the above

x12345
 y67891
 z45787
 ABC-DEF

nickhills — Mon, 10 Feb 2020 16:21:12 GMT

Hi @pavanae
Try this:

[sourcetype_X]
EXTRACT-UVW = emailUser="(?<emailUser>[^\@]+)"

Vijeta — Mon, 10 Feb 2020 16:27:53 GMT

You can extract the name as below

[sourcetype_X]
  EXTRACT-XYZ = username="(?<name>[^+\"]*)@"