Splunk Search

I want to extract an email ID using regex

DataOrg
Builder

The service with id No.[sana.hello@fajfa.com] is not found in header
The service with id No.[eddadat@wifiad.net.au] is not found in header

0 Karma

cpetterborg
SplunkTrust
SplunkTrust

If you need to change the data before it is indexed, then you can use something similar to the following in your props.conf file:

[your-source-type]
SEDCMD-anonemail = s/(No\.\s*\[)[^\]+/\1#####@#####/

If your data actually differs some from your example data, you may have to adjust, but this regex will result in an obfuscated email address inside the square brackets.

0 Karma

harsmarvania57
Ultra Champion

Hi @premranjithj,

Please use regex with sed mode | rex mode=sed "s/(.*)\[(.*)\]/\1[#####]/g"

Based on sample data I have created below query (First 3 lines are used to generate dummy data)

| makeresults 
| eval _raw="The service with id No.[sana.hello@fajfa.com] is not found in hdaher"
| append [ | makeresults | eval _raw="The service with id No.[eddadat@wifiad.net.au] is not found in headder"]
| rex mode=sed "s/(.*)\[(.*)\]/\1[#####]/g"

which is giving below output

The service with id No.[#####] is not found in hdaher
The service with id No.[#####] is not found in headder

EDIT: If you don't want to mask email ID and you want to remove it totally then use regex | rex mode=sed "s/(.*)\[(.*)\]/\1/g"

Sample query:

| makeresults 
| eval _raw="The service with id No.[sana.hello@fajfa.com] is not found in hdaher"
| append [ | makeresults | eval _raw="The service with id No.[eddadat@wifiad.net.au] is not found in headder"]
| rex mode=sed "s/(.*)\[(.*)\]/\1/g"

Which gives output as below

The service with id No. is not found in hdaher
The service with id No. is not found in headder

I hope this helps.

Thanks,
Harshil

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...