Splunk Search

How to Trim string at @ - need help creating rex search

katzr
Path Finder

Hello,

I cannot figure out the syntax of the rex function. I have a field called email with multiple domains: katz.r@blah.com example@blahblah.com. I need to create a new field where just katz.r and example are returned- so it is cut off at the @ sign. I cannot figure out the syntax of rex to write it and the split function keeps both the values: katz.r and blah.com-which is not what I want. I also tried rtim but I that isn't working for a field- just a given string.

Thanks for the help!

0 Karma
1 Solution

cpetterborg
SplunkTrust
SplunkTrust

So if you just want to isolate the username from the domain in the email field into a new field (I'm using user), you can do that something like this:

... | eval user=email | rex field=user mode=sed "s/@\S+//g"

View solution in original post

niketn
Legend

@katzr, Similar question was asked a day before... https://answers.splunk.com/answers/569242/having-difficulties-at-search-trying-to-use-sed-to.html. @cpetterborg, with accepted answer to that question, has already answered here with his accepted answer using sed, following is rex on similar lines but without sed:

 | makeresults
 | eval _raw="user@domain.com" 
 | rex "(?<user>[^@]+)@"
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

cpetterborg
SplunkTrust
SplunkTrust

So if you just want to isolate the username from the domain in the email field into a new field (I'm using user), you can do that something like this:

... | eval user=email | rex field=user mode=sed "s/@\S+//g"

s2_splunk
Splunk Employee
Splunk Employee
| makeresults | eval email="anybody@mail.com" | rex field=email "^(?<firstPart>.*)@" | table email, firstPart

I am assuming your events have a field called 'email' with just one value per event, but across events there are multiple values.
If your email field contains multiple email addresses in each event, the approach would be different. So please clarify, if this is not what you need.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi
why do you want to use regex?
try using makemv and mvexpand, something like this
index=_internal | head 1| eval IP="katz.r@blah.com example@blahblah.com" | makemv IP | mvexpand IP | table IP
Bye.
Giuseppe

0 Karma

katzr
Path Finder

I need to perform this action for the whole field email- not just those example strings

0 Karma

gcusello
SplunkTrust
SplunkTrust

Could you share an example to extract fields?
Bye.
Giuseppe

0 Karma

katzr
Path Finder

The field is called email and contains values of a typical email. And I want a new field that just includes the portion of the email string before the @.

So katz.r@blahblah.com is a value in the field Email. And I want just katz.r in a new field.

0 Karma

katzr
Path Finder

Thanks for help!

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...