Sub a string until a specific character - Splunk Community

Splunk Search

Hello, I Need to know how can I trim a string from the begining until a specific character. For example, I have the the field data which contains emails so how can I trim the emails until "@" and let the rest in the field.

before: [email protected]
After:@babla.com

Thank you for your help 🙂

Hi

Try like

| makeresults 
| eval email="[email protected]" 
| eval result = replace(email,"^[^\@]+","")

It's rex to the rescue. Try this.

... | rex mode=sed field=foo "s/[^@]+(@.*)/\1/" | ...

---
If this reply helps you, Karma would be appreciated.

Get Updates on the Splunk Community!

Think Like an Architect: Introducing the Splunk Certified Cybersecurity Defense ...

In cybersecurity, defenders respond to threats. Architects design the systems that stop them. As ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...