Sub a string until a specific character - Splunk Community

Splunk Search

Hello, I Need to know how can I trim a string from the begining until a specific character. For example, I have the the field data which contains emails so how can I trim the emails until "@" and let the rest in the field.

before: [email protected]
After:@babla.com

Thank you for your help 🙂

Hi

Try like

| makeresults 
| eval email="[email protected]" 
| eval result = replace(email,"^[^\@]+","")

It's rex to the rescue. Try this.

... | rex mode=sed field=foo "s/[^@]+(@.*)/\1/" | ...

---
If this reply helps you, Karma would be appreciated.

Get Updates on the Splunk Community!

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...

Request for Professional Development: Attending .conf26

Winning Over the Boss: Your Pass to .conf26 conf26 is going to be here before you know it. If don't already ...

Casting Call: Compete in Cyber Games

Lights, Camera, SecOps: Apply to Compete in Cyber Games Think you have what it takes to beat the clock? ...