Splunk Search

How to Trim string at @ - need help creating rex search

Path Finder

Hello,

I cannot figure out the syntax of the rex function. I have a field called email with multiple domains: katz.r@blah.com example@blahblah.com. I need to create a new field where just katz.r and example are returned- so it is cut off at the @ sign. I cannot figure out the syntax of rex to write it and the split function keeps both the values: katz.r and blah.com-which is not what I want. I also tried rtim but I that isn't working for a field- just a given string.

Thanks for the help!

0 Karma
1 Solution

SplunkTrust
SplunkTrust

So if you just want to isolate the username from the domain in the email field into a new field (I'm using user), you can do that something like this:

... | eval user=email | rex field=user mode=sed "s/@\S+//g"

View solution in original post

Legend

@katzr, Similar question was asked a day before... https://answers.splunk.com/answers/569242/having-difficulties-at-search-trying-to-use-sed-to.html. @cpetterborg, with accepted answer to that question, has already answered here with his accepted answer using sed, following is rex on similar lines but without sed:

 | makeresults
 | eval _raw="user@domain.com" 
 | rex "(?<user>[^@]+)@"
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

SplunkTrust
SplunkTrust

So if you just want to isolate the username from the domain in the email field into a new field (I'm using user), you can do that something like this:

... | eval user=email | rex field=user mode=sed "s/@\S+//g"

View solution in original post

Splunk Employee
Splunk Employee
| makeresults | eval email="anybody@mail.com" | rex field=email "^(?<firstPart>.*)@" | table email, firstPart

I am assuming your events have a field called 'email' with just one value per event, but across events there are multiple values.
If your email field contains multiple email addresses in each event, the approach would be different. So please clarify, if this is not what you need.

0 Karma

SplunkTrust
SplunkTrust

Hi
why do you want to use regex?
try using makemv and mvexpand, something like this
index=_internal | head 1| eval IP="katz.r@blah.com example@blahblah.com" | makemv IP | mvexpand IP | table IP
Bye.
Giuseppe

0 Karma

Path Finder

I need to perform this action for the whole field email- not just those example strings

0 Karma

SplunkTrust
SplunkTrust

Could you share an example to extract fields?
Bye.
Giuseppe

0 Karma

Path Finder

The field is called email and contains values of a typical email. And I want a new field that just includes the portion of the email string before the @.

So katz.r@blahblah.com is a value in the field Email. And I want just katz.r in a new field.

0 Karma

Path Finder

Thanks for help!

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!