How to Trim string at @ - need help creating rex search

[katzr]

Hello,

I cannot figure out the syntax of the rex function. I have a field called email with multiple domains: [email protected] [email protected]. I need to create a new field where just katz.r and example are returned- so it is cut off at the @ sign. I cannot figure out the syntax of rex to write it and the split function keeps both the values: katz.r and blah.com-which is not what I want. I also tried rtim but I that isn't working for a field- just a given string.

Thanks for the help!

[niketn]

@katzr, Similar question was asked a day before... https://answers.splunk.com/answers/569242/having-difficulties-at-search-trying-to-use-sed-to.html. @cpetterborg, with accepted answer to that question, has already answered here with his accepted answer using sed, following is rex on similar lines but without sed:

 | makeresults
 | eval _raw="[email protected]" 
 | rex "(?<user>[^@]+)@"

[cpetterborg · Accepted solution]

So if you just want to isolate the username from the domain in the email field into a new field (I'm using user), you can do that something like this:

... | eval user=email | rex field=user mode=sed "s/@\S+//g"

[s2_splunk]

| makeresults | eval email="[email protected]" | rex field=email "^(?<firstPart>.*)@" | table email, firstPart

I am assuming your events have a field called 'email' with just one value per event, but across events there are multiple values.
If your email field contains multiple email addresses in each event, the approach would be different. So please clarify, if this is not what you need.

[gcusello]

Hi
why do you want to use regex?
try using makemv and mvexpand, something like this
index=_internal | head 1| eval IP="[email protected] [email protected]" | makemv IP | mvexpand IP | table IP
Bye.
Giuseppe

[katzr]

I need to perform this action for the whole field email- not just those example strings

[gcusello]

Could you share an example to extract fields?
Bye.
Giuseppe

[katzr]

The field is called email and contains values of a typical email. And I want a new field that just includes the portion of the email string before the @.

So [email protected] is a value in the field Email. And I want just katz.r in a new field.

[katzr]

Thanks for help!