Splunk Search

How to extract a part of a field?

reschal
Explorer

Hey,

i have got a field extraction called mail. So i get different kind of mails as output.

But it appears the following problem: All the mail adresses have a "." at the end and i want to remove the ".".

For example: "xy.z@yahoo.com." shall be "xy.z@yahoo.com"

I tried to solve the problem by extracting the expression without the "." but it won't work.

|rex field=mail "(?<mail>[\s]+)-."

Thanks for your help!

Tags (1)
0 Karma
1 Solution

mayurr98
Super Champion

Try this

| rex field=mail "(?P<mail>[^\s]+)\."

Let me know if it helps!

View solution in original post

0 Karma

Yunagi
Communicator

If you really want to change the field with a Splunk search, then try the following:

| eval mail=substr(mail,0,len(mail)-1)

However, I think the better approach is to improve the actual field extraction. Can you provide the field extraction under Settings/Fields/Field extractions?

0 Karma

mayurr98
Super Champion

Try this

| rex field=mail "(?P<mail>[^\s]+)\."

Let me know if it helps!

0 Karma

reschal
Explorer

It works. Thanks very much 🙂

0 Karma
Get Updates on the Splunk Community!

Your Guide to SPL2 at .conf24!

So, you’re headed to .conf24? You’re in for a good time. Las Vegas weather is just *chef’s kiss* beautiful in ...

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...