Splunk Search

How to extract substring from field?

DavideASR
Engager

Hi, i'm trying to extract substring from a field1 to create field3 and then match field2 with field3 

 

The search is:

index=antispam sourcetype=forcepointmail:sec 
| fields msg suser from
| where NOT LIKE(suser,"%".from."%")

But

from=Domain noreply <noreply@domain.com> 

suser=noreply@domain.com

I need to extract the substring contained between <> in the "from"  field and match field "suser" with "created_field" .

 

I want to find each mail where the "From" field is different from "suser" field, so I can find spoofed mails on our antispam device.

 

thx

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

To extract the email address from the from field, use the rex command.

| rex field=from "\<(?<fuser>[^>]+)"

 

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Swap the fields in the like function.  The first field is the one being examined and suser is the field that's part of the from field.

| where NOT LIKE(from,"%".suser."%")

 

---
If this reply helps you, Karma would be appreciated.

DavideASR
Engager

Ok it helps but isn't the solution,

from= Name Surname <name.surname@domain.com>

suser= name.surname@domain.com

i have to create a field with the substring between <>

created_field=name.surname@domain.com extracted in the "from" field  between the <>

0 Karma

richgalloway
SplunkTrust
SplunkTrust

To extract the email address from the from field, use the rex command.

| rex field=from "\<(?<fuser>[^>]+)"

 

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...