Splunk Search

How to create a regex domain to not include "@" and terminate capture before ">"?

Log_wrangler
Builder

Hi,
I have been tinkering with regex101 for some time now and no luck.

I have a field called sender

Return-Path:<someName@someDomain.com>
Return-Path:<someName@someDomain.com.blah>

I want to regex the sender so that I get

someDomain.com
someDomain.com.blah

So I want the string to start after @ and end before >

here is what I started with

... | rex field=sender "@(?<domain>.*)"  

Thank you

Tags (2)
0 Karma
1 Solution

FrankVl
Ultra Champion

Close, try this:

| rex field=sender "@(?<domain>[^\>]+)"

You want to read only characters not equal to >. https://regex101.com/r/WbsXgT/1

View solution in original post

jkat54
SplunkTrust
SplunkTrust

I like this approach myself

 (?<=@)(?<domainName>.*)(?=>)
0 Karma

FrankVl
Ultra Champion

Any reason for why you like that approach? It is harder to read and if I interpret the regex101 execution info correctly a lot less efficient than a straightforward "@(?<domain>.[^\>]+)".

Given the 2 line sample from the question, regex101 reports 13 steps for my solution and 125 steps for yours.

0 Karma

jkat54
SplunkTrust
SplunkTrust

Oh it’s less efficient for sure. I like it because it opens the user’s eyes to reverse and forward lookups etc.

0 Karma

Log_wrangler
Builder

thanks, I will check it out

0 Karma

ddrillic
Ultra Champion

Just add the >, such as - ... | rex field=sender "@(?<domain>.*)>"

0 Karma

jodyfsu
Path Finder

Try this:

| rex field=sender "@(?<domain>.[^\>]+)"
0 Karma

Log_wrangler
Builder
"@(?<domain>.*)>"
0 Karma

FrankVl
Ultra Champion

Close, try this:

| rex field=sender "@(?<domain>[^\>]+)"

You want to read only characters not equal to >. https://regex101.com/r/WbsXgT/1

Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...