Splunk Search

How can I extract string between highlighted fields with regex?

vik123ash
Explorer

Error: Update failed. First exception on row 0 with id abcd; first error: INVALID_EMAIL_ADDRESS, Email: invalid email address: jrwils@secuamp;gt;: [Email]

0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi vik123ash,
you can use

invalid\semail\saddress:\s(?<invalid_email>[^\[]*)\[Email\]

test it at https://regex101.com/r/hUzreZ/2

Bye.
Giuseppe

View solution in original post

0 Karma

vik123ash
Explorer

Thanks Giuseppe

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi vik123ash,
you can use

invalid\semail\saddress:\s(?<invalid_email>[^\[]*)\[Email\]

test it at https://regex101.com/r/hUzreZ/2

Bye.
Giuseppe

0 Karma

harsmarvania57
Ultra Champion

Hi @vik123ash,

You can use below query to extract email address in new field called Email

... <your search> ... | rex field=_raw "(?:[^\:]*\:){4}(?<Email>.*)\["

I hope this helps.

Thanks,
Harshil

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...