Getting Data In

Regex during getting data in

bosseres
Contributor

Hello Everyone,

I have a question. I have events like:

Mon Mar 19 20:16:03 2018 Info: Delayed: DCID 8414309 MID 19410908 From: <WeiZhang@example.com> To: <mcintosh@buttercupgames.com> RID 0 - 4.3.2 - Not accepting messages at this time ('421', ['4.3.2 try again later'])

I wrote a regex expression to cut email adresses from the events - <\w+@\w+.\w+>

How can I set this expression to get ONLY email addresses from logs? I need to do it on gettind data in phase, not after (I download data from simple txt file). Thank you.

Labels (1)
0 Karma
1 Solution

scelikok
SplunkTrust
SplunkTrust

Hi @bosseres,

You should use below settings on your props.conf and transforms.conf

props.conf
[your_sourcetype]
TRANSFORMS-clear_data = keep_email

transforms.conf
[keep_email]
REGEX = \<(\w+@\w+.\w+)\>
FORMAT = $1
DEST_KEY = _raw
If this reply helps you an upvote and "Accept as Solution" is appreciated.

View solution in original post

scelikok
SplunkTrust
SplunkTrust

Hi @bosseres,

You should use below settings on your props.conf and transforms.conf

props.conf
[your_sourcetype]
TRANSFORMS-clear_data = keep_email

transforms.conf
[keep_email]
REGEX = \<(\w+@\w+.\w+)\>
FORMAT = $1
DEST_KEY = _raw
If this reply helps you an upvote and "Accept as Solution" is appreciated.

saravanan90
Contributor

Try adding the parameter max_match=0 

 

base search | rex max_match=0 "regexexpression"

 

bosseres
Contributor

Thank you for responding. 

I need to cut email adresses on adding data phase, not when it's already indexed. 

 

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...