How to extract username from my data?

[thambisetty_bal]

Hi Splunkers,

I have been struggling to extract user name from below values of user.

user
--------
user1@sa.com
sab\user2
user3

OUTPUT
------------
user1
user2
user3

kindly help me out..

[somesoni2 · Accepted solution]

Give this a try. (Runanywhere sample search, first line is just to generate sample data).

| gentimes start=-1 | eval user="user1@sa.com sab\user2 user3" | table user | makemv user | mvexpand user 
| rex field=user "(?<cleanedUser>\w+)(\@|$)"

[thambisetty_bal]

you are amazing @somesoni2

please explain regex Sir.

[somesoni2]

It's capturing a full work (\w+) till you encounter a @ symbol or end of value ($). backward slash is word terminator so it works for 2nd example value as well.