topic Re: Please help me in forming Regex. in Splunk Search

Please help me in forming Regex.

ansif — Tue, 21 Nov 2017 04:00:07 GMT

Hi All,

Please help me to extract the email ids which is not between <> angle brackets.

Sample event:

someone@domain.com,someone1@domain.com,someone2@domain.com,someone3@domain.com,

Not able to include a mail id between angle brackets.So consider a mail id is there in the above list between <> angle brackets.

Expected output:

someone@domain.com,someone1@domain.com,someone2@domain.com,someone3@domain.com,

The Regex:

([A-z0-9._%+-]+@[A-z0-9.-]+.[A-z]{2,63}) this extracts all email ids.

Re: Please help me in forming Regex.

niketn — Tue, 21 Nov 2017 06:09:25 GMT

Ansif, you can use code button (one with 101010) to escape special characters. I hope following is the question you intended to ask.

someone@domain.com,someone1@domain.com,<someone2@domain.com>,someone3@domain.com,

So should your output also have angular bracket when you extract email?

([<A-z0-9._%+-]+@[A-z0-9.-]+.[A-z>]{2,63})

Re: Please help me in forming Regex.

DalJeanis — Tue, 21 Nov 2017 13:23:10 GMT

Try this -

| rex field=myfield "\<?(<MyEmail>[A-z0-9._%+-]+@[A-z0-9.-]+.[A-z]{2,63})\>?(,|$)" max_match=0

That should extract each email to a multi-value field, leaving out the angle brackets.

Re: Please help me in forming Regex.

niketn — Tue, 21 Nov 2017 13:38:29 GMT

@DalJeanis, while this should be confirmed by @ansif, I think his original query was already extracting emails correctly even if it was within angular brackets. I think what Ansif required was angular brackets to be included in the extraction not excluded. But due to the omissions in his post requirement is not quite clear. We can wait for him to respond back.

Re: Please help me in forming Regex.

DalJeanis — Tue, 21 Nov 2017 14:49:16 GMT

That would be this...

| rex field=myfield "(<MyEmail>\<?[A-z0-9._%+-]+@[A-z0-9.-]+.[A-z]{2,63}\>?)(,|$)" max_match=0

Re: Please help me in forming Regex.

ansif — Tue, 21 Nov 2017 16:01:20 GMT

Thanks Niket and Dal.

I need to exclude mail ids which is surrounded with angle brackets.like Ansif.d@splunk.com and thirich.89@splunk.com should be extracted in the below sample:

Ansif.d@splunk.com thirich.89@splunk.com

Re: Please help me in forming Regex.

ansif — Tue, 21 Nov 2017 16:01:58 GMT

Not able to include a sample mail IDs with angle brackets

Re: Please help me in forming Regex.

DalJeanis — Tue, 21 Nov 2017 16:12:36 GMT

Then that would be this

| rex field=myfield "(?<![A-z0-9._%+-\<])(<MyEmail>\<?[A-z0-9._%+-]+@[A-z0-9.-]+.[A-z]{2,63})(,|$)" max_match=0

This little beauty (?<![A-z0-9._%+-\<]) is a negative lookback that translates as
" (?<! that is not preceded by [A-z0-9._%+-\<] any of the listed characters (including <)"

You can't use just (?<!\<) to eliminate the open bracket because that would just drop the first character of the email address and take up extracting from the second one.

You don't have to check for the close bracket at the end, because that address will already have been eliminated by not having anything before the @ sign.