Regex to extract email domain name

[davidcraven02]

I have two regexes below which are pulling the domain name of the email sender (from). i.e linkedin.com, amazones.com.

However I cant create one regex to pull them both in one as they aren't always in the same format.

index=fortimail source=/var/log/messages/splunk/fortimail/*-fortimail.log 
| dedup   date, time, to, from, domain, subject
| rex field=from "(.*@.*\.(?<domainname>.*\..*)$)"
| rex field=from ".*@(?<domainname2>.*\..*)$" 
| table date, time, to, from, domainname, domainname2, subject, message_length

[tiagofbmm]

Try this generic example

| makeresults 
| eval to="tiago@lalala.domain1.com" 
| append [ | makeresults 
| eval to="tiago@domain2.com" ]
| append [ | makeresults | eval to="firstname.surname@test.co.uk" ]
| rex field=to "@(.*\.)*(?<Domain>.*\..*)"

The test.co.uk is an outlier to this rule? Did you want domain to be test.co.uk? Then you have the same exact format but you want two different behaviours?

Regex doesn't work like that

[BearMormont · Accepted solution]

This should work with any domain (not just .com):

rex field=from ".*?(?<domainname>[\w]+\.[\w]+)$"

Edit:
Example - https://regex101.com/r/1uTWmD/1/

[davidcraven02]

It doesn't work with this example: firstname.surname@test.co.uk

Any thoughts?

[elliotproebstel]

This is a generically difficult problem. Differentiating domains from subdomains requires a priori knowledge of all top level domains (TLDs), because a domain is really just something.valid-tld, where something is composed of letters, numbers, and hyphens (if the hyphens are surrounded on both sides by letters, numbers, or other hypens; hyphens may not be the first or last character in a domain name).

To that end, you could build something yourself that does this, but you'd be reinventing the wheel. You might want to check out this blog post on UT_parsing, which describes a few Splunk add-ons/apps that you could leverage in your work.

[davidcraven02]

Thank you! Yes i thought I was maybe over complicating it.