I have the username filed extraction as follows in the props.conf which extracts the email address:-
[sourcetype_X]
EXTRACT-XYZ = username="(?<user>[^+\"]*)"
which extracts the field as follows
x12345@abc-def-ghij-01.com
y67891@klm-def-ghij-01.com
z45787@abc-def-ghij-01.com
ABC-DEF
Now what would be regex stanza to extract the username as follows from the above
x12345
y67891
z45787
ABC-DEF
Hi @pavanae
Try this:
[sourcetype_X]
EXTRACT-UVW = emailUser="(?<emailUser>[^\@]+)"
You can extract the name as below
[sourcetype_X]
EXTRACT-XYZ = username="(?<name>[^+\"]*)@"
Hi @pavanae
Try this:
[sourcetype_X]
EXTRACT-UVW = emailUser="(?<emailUser>[^\@]+)"