topic How can I extract string between highlighted fields with regex? in Splunk Search

How can I extract string between highlighted fields with regex?

vik123ash — Tue, 29 Sep 2020 16:22:27 GMT

Error: Update failed. First exception on row 0 with id abcd; first error: INVALID_EMAIL_ADDRESS, Email: invalid email address: jrwils@secuamp;gt;: [Email]

Re: How can I extract string between highlighted fields with regex?

harsmarvania57 — Mon, 23 Oct 2017 13:08:33 GMT

Hi @vik123ash,

You can use below query to extract email address in new field called Email

... <your search> ... | rex field=_raw "(?:[^\:]*\:){4}(?<Email>.*)\["

I hope this helps.

Thanks,
Harshil

Re: How can I extract string between highlighted fields with regex?

gcusello — Mon, 23 Oct 2017 13:53:31 GMT

Hi vik123ash,
you can use

invalid\semail\saddress:\s(?<invalid_email>[^\[]*)\[Email\]

test it at https://regex101.com/r/hUzreZ/2

Bye.
Giuseppe

Re: How can I extract string between highlighted fields with regex?

vik123ash — Mon, 23 Oct 2017 23:20:19 GMT

Thanks Giuseppe