topic Re: simple email regex in Splunk Search

simple email regex

kleckns — Thu, 27 Jul 2017 19:29:14 GMT

Ive been trying most of the regex solutions on this forum, but cant get any of them to work. Im trying to extract emails into a new field without any of the extra junk

field value needs regex:
 "John Doe" <john.doe@somedomain.tld>

search:
    ... | rex field=from "(?<from>(?<=<)[^>]+)" | table from, other fields, etc...

im looking for john.doe@somedomain.tld without any quotes or gt/lt characters around it in the from field

Re: simple email regex

somesoni2 — Thu, 27 Jul 2017 19:37:20 GMT

This should do it.

... | rex field=from "(\<|\;)(?<from>[^\>\;]+)" | table from, other fields, etc...

Re: simple email regex

kleckns — Fri, 28 Jul 2017 12:49:55 GMT

your regex worked great. Part of the problem was a dumb mistake on my part. i had switched the fields around in the field=email_from "(<|\;)(?[^>\;]+)"

the orig field that had the values is email_from, not from. i wanted to create a new field called from... so i had it backwards.

Thank you for the regex!