topic Re: regex help in Splunk Search

regex help

mcbradford — Thu, 11 Aug 2016 18:48:52 GMT

Not the best regex king, so I need some help please

within the field "From" in my data there are emails. Within the emails there should never be a number before the @.

For example, mark1@mydamin.com is not valid, but mark@mydomain.com is valid.

I want to find all the non valid emails.

somesoni2 — Thu, 11 Aug 2016 18:52:58 GMT

Try like this

your base search | regex From="\S+\d\@\S+"

sundareshr — Thu, 11 Aug 2016 18:56:55 GMT

Try this

.... | rex "(.*\d.*?@[^\s]+)" | ...

skoelpin — Thu, 11 Aug 2016 19:00:09 GMT

Try this..

If you want to get good with regex then go to www.regex101.com and put some sample data in and test it

This will find all emails with a number before the @ symbol

\w+\d@\w+\.com

index=foo ... | rex (?P<Bad_Email>\w+\d@\w+\.com)