Sub a string until a specific character - Splunk Community

Splunk Search

Hello, I Need to know how can I trim a string from the begining until a specific character. For example, I have the the field data which contains emails so how can I trim the emails until "@" and let the rest in the field.

before: [email protected]
After:@babla.com

Thank you for your help 🙂

Hi

Try like

| makeresults 
| eval email="[email protected]" 
| eval result = replace(email,"^[^\@]+","")

It's rex to the rescue. Try this.

... | rex mode=sed field=foo "s/[^@]+(@.*)/\1/" | ...

---
If this reply helps you, Karma would be appreciated.

Get Updates on the Splunk Community!

Vibe-coding, AI, and Splunkcraft: Highlights from the .conf26 Builder Bar

If you stopped by the Builder Bar at .conf26, thank you! This year, we brought ...

Thanks for the Memories: .conf26 Took Learning to New Heights

Thank you, Splunk Community, for making .conf26 in Denver one for the books. From packed Splunk University ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...