topic Re: strip portion of an email in Splunk Search

strip portion of an email

brownt61 — Fri, 20 Mar 2020 14:57:37 GMT

I am needing to strip a portion out of email's. I have a list of email addresses where some of them contain -priv before the @ that I need stripped out leaving what would be the "normal" email address.

example address
example-priv@email.com

I want to be left with example@email.com

can someone help me with the rex for this?

thank you

Re: strip portion of an email

woodcock — Fri, 20 Mar 2020 15:54:09 GMT

Like this:

| makeresults 
| eval email="example-priv@email.com" 
| rex field=email mode=sed "s/-[^@]+@/@/g"

Re: strip portion of an email

richgalloway — Fri, 20 Mar 2020 15:55:07 GMT

Try | rex field=email mode=sed "s/-priv//"

Re: strip portion of an email

brownt61 — Fri, 20 Mar 2020 15:59:54 GMT

Thank you, I should add that I have since noticed that there are email addresses that have an appropriate need to have - in them.

example
surname.givenname-middlename-priv@email.com

so I really need to only strip emails that have -priv in them, not any email that contains a - from the - to @

Re: strip portion of an email

brownt61 — Fri, 20 Mar 2020 16:03:31 GMT

Thank you, this worked