Splunk Search

how to extract a string before the @ symbol from an email adress?

pavanae
Builder

I have the username filed extraction as follows in the props.conf which extracts the email address:-

 [sourcetype_X]
 EXTRACT-XYZ = username="(?<user>[^+\"]*)"

which extracts the field as follows

 x12345@abc-def-ghij-01.com
 y67891@klm-def-ghij-01.com
 z45787@abc-def-ghij-01.com
 ABC-DEF

Now what would be regex stanza to extract the username as follows from the above

x12345
 y67891
 z45787
 ABC-DEF
0 Karma
1 Solution

nickhills
Ultra Champion

Hi @pavanae
Try this:

[sourcetype_X]
EXTRACT-UVW = emailUser="(?<emailUser>[^\@]+)"
If my comment helps, please give it a thumbs up!

View solution in original post

0 Karma

Vijeta
Influencer

You can extract the name as below

[sourcetype_X]
  EXTRACT-XYZ = username="(?<name>[^+\"]*)@"
0 Karma

nickhills
Ultra Champion

Hi @pavanae
Try this:

[sourcetype_X]
EXTRACT-UVW = emailUser="(?<emailUser>[^\@]+)"
If my comment helps, please give it a thumbs up!
0 Karma
Get Updates on the Splunk Community!

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Shape the Future of Splunk: Join the Product Research Lab!

Join the Splunk Product Research Lab and connect with us in the Slack channel #product-research-lab to get ...