topic How to Trim string at @ - need help creating rex search in Splunk Search

How to Trim string at @ - need help creating rex search

katzr — Tue, 12 Sep 2017 17:24:44 GMT

Hello,

I cannot figure out the syntax of the rex function. I have a field called email with multiple domains: katz.r@blah.com example@blahblah.com. I need to create a new field where just katz.r and example are returned- so it is cut off at the @ sign. I cannot figure out the syntax of rex to write it and the split function keeps both the values: katz.r and blah.com-which is not what I want. I also tried rtim but I that isn't working for a field- just a given string.

Thanks for the help!

Re: How to Trim string at @ - need help creating rex search

gcusello — Tue, 12 Sep 2017 17:34:50 GMT

Re: How to Trim string at @ - need help creating rex search

katzr — Tue, 12 Sep 2017 17:38:11 GMT

I need to perform this action for the whole field email- not just those example strings

Re: How to Trim string at @ - need help creating rex search

gcusello — Tue, 12 Sep 2017 17:47:53 GMT

Could you share an example to extract fields?
Bye.
Giuseppe

Re: How to Trim string at @ - need help creating rex search

katzr — Tue, 12 Sep 2017 17:51:13 GMT

The field is called email and contains values of a typical email. And I want a new field that just includes the portion of the email string before the @.

So katz.r@blahblah.com is a value in the field Email. And I want just katz.r in a new field.

Re: How to Trim string at @ - need help creating rex search

katzr — Tue, 12 Sep 2017 17:51:23 GMT

Thanks for help!

Re: How to Trim string at @ - need help creating rex search

s2_splunk — Tue, 12 Sep 2017 18:11:23 GMT

| makeresults | eval email="anybody@mail.com" | rex field=email "^(?<firstPart>.*)@" | table email, firstPart

I am assuming your events have a field called 'email' with just one value per event, but across events there are multiple values.
If your email field contains multiple email addresses in each event, the approach would be different. So please clarify, if this is not what you need.

Re: How to Trim string at @ - need help creating rex search

cpetterborg — Tue, 12 Sep 2017 18:42:21 GMT

So if you just want to isolate the username from the domain in the email field into a new field (I'm using user), you can do that something like this:

... | eval user=email | rex field=user mode=sed "s/@\S+//g"

Re: How to Trim string at @ - need help creating rex search

niketn — Tue, 12 Sep 2017 19:03:46 GMT

@katzr, Similar question was asked a day before... https://answers.splunk.com/answers/569242/having-difficulties-at-search-trying-to-use-sed-to.html. @cpetterborg, with accepted answer to that question, has already answered here with his accepted answer using sed, following is rex on similar lines but without sed:

 | makeresults
 | eval _raw="user@domain.com" 
 | rex "(?<user>[^@]+)@"