How to extract substring from field?

[DavideASR]

Hi, i'm trying to extract substring from a field1 to create field3 and then match field2 with field3 

The search is:

index=antispam sourcetype=forcepointmail:sec 
| fields msg suser from
| where NOT LIKE(suser,"%".from."%")

But

from=Domain noreply <[email protected]> 

[email protected]

I need to extract the substring contained between <> in the "from"  field and match field "suser" with "created_field" .

I want to find each mail where the "From" field is different from "suser" field, so I can find spoofed mails on our antispam device.

thx

[richgalloway]

Swap the fields in the like function.  The first field is the one being examined and suser is the field that's part of the from field.

| where NOT LIKE(from,"%".suser."%")

[DavideASR]

Ok it helps but isn't the solution,

from= Name Surname <[email protected]>

suser= [email protected]

i have to create a field with the substring between <>

[email protected] extracted in the "from" field  between the <>

[richgalloway · Accepted solution]

To extract the email address from the from field, use the rex command.

| rex field=from "\<(?<fuser>[^>]+)"