Hi Splunkers,
I have been struggling to extract user name from below values of user.
user -------- [email protected] sab\user2 user3 OUTPUT ------------ user1 user2 user3
kindly help me out..
Give this a try. (Runanywhere sample search, first line is just to generate sample data).
| gentimes start=-1 | eval user="[email protected] sab\user2 user3" | table user | makemv user | mvexpand user | rex field=user "(?<cleanedUser>\w+)(\@|$)"
View solution in original post
you are amazing @somesoni2
please explain regex Sir.
It's capturing a full work (\w+) till you encounter a @ symbol or end of value ($). backward slash is word terminator so it works for 2nd example value as well.
@
$
