Splunk Enterprise

How to extract from and To fields For this below Line using Regex?

Kumar2
Loves-to-Learn Lots

 

Info: Bounced: DCID 8413617 MID 19338947 From: <MariaDubois@example.com> To: <abcdef@buttercupgames.com> RID 0 - 5.4.7 - Delivery expired (message too old) ('000', ['timeout'])

O/p:

from_mail_id = MariaDubois@example.com
to_mail_id = abcdef@buttercupgames.com

Please help me with the Solution ,Thanks 

Labels (1)
0 Karma

Kumar2
Loves-to-Learn Lots

Thank you Sir ,But need the Solution using only Regex .

Please help, Thanks in advance 

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

if you want to pick those values from events then you need a rex and if you want to select events which contains that kind of parts, but don't want to select those to the new fields then you should use regex.

r. Ismo

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

You could try this (I suppose that you have above data already in splunk _raw field).

 

... <your search> ..
| rex "From: <(?<from_mail_id>[^>]+)> To: <(?<to_mail_id>[^>]+)>"

r. Ismo

 

0 Karma

Kumar2
Loves-to-Learn Lots

Hi @isoutamo sir

How to  extract this event into four different counts using rex 

1234-5678-9101-1213 

example :   Count1-1234  count2-5678 and so on.....

please help me with solution, thanks in advance

0 Karma

isoutamo
SplunkTrust
SplunkTrust

You could use e.g this

...
| rex "(?<count-1>\d+)-(?<count-2>\d+)-(?<count-3>\d+)-(?<count-4>\d+)"

 You can learn to use rex with regex101.com https://regex101.com/r/ZPQDgg/1

 

 

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...