Splunk Search

Regex for extracting email with a trailing whitespace

nmayafit
Path Finder

Hi,

I have log line according to the next template: [2017-11-03 13:55:52,945] [MYPROJ] [EMAIL=xxx@yyy.com]

But I want to find users (EMAIL) where the user inserted a whitespace at the start/end of the email: [2017-11-03 13:55:52,945] [MYPROJ] [EMAIL=xxx@yyy.com ] <- notice the end of the email

Somehow no regex will find it.

Is there something in the splunk admin conf that will trim the whitespace automatically?

Thanks

0 Karma
1 Solution

micahkemp
Champion

| rex "(?<email_with_trailing_space>\[EMAIL=[^]]+ \])" | search email_with_trailing_space=*

That will extract the full [EMAIL=...] portion of the log and allow you to search for a space before the closing ].

View solution in original post

DalJeanis
Legend

This line, in a search, will alter field EMAIL so that all spaces are deleted.

| rex field=EMAIL mode=sed "s/ //g"

You can also sedmode the events at the indexer while you are ingesting them, which alters the underlying _raw data.

SEDCMD-foo s/(\[EMAIL=)(\s*)(\S*)(\s*)(\S*)(\s*)(\])/\1\3\5\7/g
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

HI,

Can you please try rex? This rex will extract EMAIL ID and blank space (if any)

.*EMAIL=(?<EMAIL_ID>.*)(?<BLANK_SPACE>[|.\s])

You can try below search also.

YOUR_SEARCH
| rex field=_raw.*EMAIL=(?<EMAIL_ID>.*)(?<BLANK_SPACE>[|.\s])
| table _time EMAIL_ID BLANK_SPACE

This search will list you eail_is as well as BLANK Space at ed of email id(if any).

0 Karma

micahkemp
Champion

| rex "(?<email_with_trailing_space>\[EMAIL=[^]]+ \])" | search email_with_trailing_space=*

That will extract the full [EMAIL=...] portion of the log and allow you to search for a space before the closing ].

nmayafit
Path Finder

Great catch. REALLY not according to splunk's docs ([\s] etc.)

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...