Hi,
I am really new to Splunk and Regular Expression stuff. I was planning to extract just the domain names of all e-mail senders in my SMTP Log. For example, If the sender field value is store_news @amazon.com
, then I just want to extract the domain name which is amazon.com
. Can somebody please provide me a way to perform this?
Thanks
Appreciated
Here is another one
@(?\w+.\w{3})
This one won't work for all email addresses...
Agreed, there are top level domains with shorter and longer lengths. Also the dot isn't escaped.
https://answers.splunk.com/answers/338138/how-to-search-for-and-extract-email-ids-with-dot-t.html
https://answers.splunk.com/answers/190126/how-to-extract-only-the-top-level-domain-tld-from.html
If you are uncomfortable with regular expressions, you can use the Interactive Field Extractor. Documentation here: http://docs.splunk.com/Documentation/Splunk/6.3.2/Knowledge/ExtractfieldsinteractivelywithIFX
Try something like this
your base search | eval sender_domain=mvindex(split(sender,"@"),-1) .....
OR
your base search | rex field=sender ".*@(?<sender_domain>.*)"
Based on your answer, I used the following to extract the domain part and sort by number of occurrences for the top 20:
your base search | eval sender_domain=mvindex(split(sender,"@"),-1) | top limit=20 sender_domain