https://community.splunk.com/t5/Splunk-Search/sendmail-addresses/m-p/23976#M4341 <P>I have a list of email addresses I need to process. Some of the emails begin with a &lt; and end with a &gt;. Some do not. I need all addresses to not include these characters.</P> <P>I've developed the following script which strips out these characters, but how do I tell the script to ignore addresses that don't include the &lt; or &gt; symbol?</P> <P>index=syslog_data sendmail | top to | eval T1=split(to, "&lt;") | eval first=mvindex(T1,1) | eval T2=split(first, "&gt;") | eval second=mvindex(T1,2)</P> <P>Thanks in advance</P> Thu, 07 Feb 2013 20:52:14 GMT DTERM 2013-02-07T20:52:14Z https://community.splunk.com/t5/Splunk-Search/sendmail-addresses/m-p/23976#M4341 <P>I have a list of email addresses I need to process. Some of the emails begin with a &lt; and end with a &gt;. Some do not. I need all addresses to not include these characters.</P> <P>I've developed the following script which strips out these characters, but how do I tell the script to ignore addresses that don't include the &lt; or &gt; symbol?</P> <P>index=syslog_data sendmail | top to | eval T1=split(to, "&lt;") | eval first=mvindex(T1,1) | eval T2=split(first, "&gt;") | eval second=mvindex(T1,2)</P> <P>Thanks in advance</P> Thu, 07 Feb 2013 20:52:14 GMT https://community.splunk.com/t5/Splunk-Search/sendmail-addresses/m-p/23976#M4341 DTERM 2013-02-07T20:52:14Z https://community.splunk.com/t5/Splunk-Search/sendmail-addresses/m-p/23977#M4342 <P>Consider this:</P> <PRE><CODE>| gentimes start=-1 increment=5m | eval email = if((starttime % 600) = 0, "&lt;foo@bar.com&gt;", "bar@foo.com") | eval fixedemail = replace(email, "(^&lt;)|(&gt;$)", "") </CODE></PRE> Thu, 07 Feb 2013 22:56:51 GMT https://community.splunk.com/t5/Splunk-Search/sendmail-addresses/m-p/23977#M4342 martin_mueller 2013-02-07T22:56:51Z