Splunk Search

regex to extract multiple email addresses in splunk search

pavanae
Builder

How to list out all the email addresses in a splunk search which displays the following results.

Storing shipConfirm email for abcabac123@msn.com
Storing shipConfirm email for lkgjdlgfk@hotmail.co.uk
Storing shipConfirm email for def.t.khv@gmail.co
and so on

0 Karma
1 Solution

somesoni2
Revered Legend

Try something like this

Your current search giving above output | rex field=YourFieldContainingEmailAddressLine max_match=0 "(?<email>[\w\d\.\-]+\@[\w\d\.]+)" 

View solution in original post

mkretsch
New Member

I will suggest slightly improved version to cover some rare naming cases

(?<email>[\w\d\.\-\_]+\@[\w\d\.\-\_]+\.[\w\d]+)
0 Karma

somesoni2
Revered Legend

Try something like this

Your current search giving above output | rex field=YourFieldContainingEmailAddressLine max_match=0 "(?<email>[\w\d\.\-]+\@[\w\d\.]+)" 

pavanae
Builder

Thanks it worked

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...