Good Day Splunkers! I've been banging me my trying to capture all email address as recipients. Is this even possible?
"status":"delivered":"recipient":"some.name@mail.com":"subject":"Thank you!":"
"status":"delivered":"recipient":"some.middle.name@mail.com":"subject":"Thank you!":"
"status":"delivered":"recipient":"\"Name Some \"<some.name@mail.com>":"subject":"Thank you!":"
"status":"delivered":"recipient":"some.name@mail.com, another.name@mail.com, more.names@mail.com subject":"Thank you!":"
"recipient":"\"different.name@mail.com\" <different.name@mail.com>, \"same.name@mail.com\"<same.name@mail.com>":"subject":"Thank you!":"
Hi @Will_powr,
having you so different formats, you could try using this regex
| rex "(?<mail>(\w+\.)*\w+@\w+\.\w+)"
that probably extract too many values.
Otherwise, you could use more regexes for each format:
| rex "\"(?<mail>(\w+\.)*\w+@\w+\.\w+)"
| rex "\<(?<mail>(\w+\.)*\w+@\w+\.\w+)\>"
that you can test at
https://regex101.com/r/fP9DAo/1
Ciao.
Giuseppe
Hi @Will_powr ... may we know, if you are trying to do this with SPL Rex search query
or
while log ingestion itself you would like to extract the email address, please suggest, thanks.