Splunk Cloud Platform

Finding logs with special characters

binay2634
Explorer

Hi All,

I have been trying to extract userids which has special characters in it but with no luck.

For ex let's say a field name uid contains two userids one is "roboticts@gmail.com" and the other one is "difficult+1@gmail.com".

Now I want to write a query which could extract only the uid with + sign in it.  Please help on this

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Assuming only 1 + and user id is in quotes.

| rex "(?<userid>[^\"]+\+[^\"]+@[^\"]+)"

 

View solution in original post

binay2634
Explorer

Thank you for suggesting, it worked

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Assuming only 1 + and user id is in quotes.

| rex "(?<userid>[^\"]+\+[^\"]+@[^\"]+)"

 

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas     Cisco Live 2026 is almost here, and this ...

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Hello Splunkers,   So you searched, “what is the name of the usb key inserted by bob smith?”  Not gonna lie… ...

Automating Threat Operations and Threat Hunting with Recorded Future

    Automating Threat Operations and Threat Hunting with Recorded Future June 29, 2026 | Register   Is your ...