Splunk Search

how to extract a string before the @ symbol from an email adress?

Builder

I have the username filed extraction as follows in the props.conf which extracts the email address:-

 [sourcetype_X]
 EXTRACT-XYZ = username="(?<user>[^+\"]*)"

which extracts the field as follows

 x12345@abc-def-ghij-01.com
 y67891@klm-def-ghij-01.com
 z45787@abc-def-ghij-01.com
 ABC-DEF

Now what would be regex stanza to extract the username as follows from the above

x12345
 y67891
 z45787
 ABC-DEF
0 Karma
1 Solution

Ultra Champion

Hi @pavanae
Try this:

[sourcetype_X]
EXTRACT-UVW = emailUser="(?<emailUser>[^\@]+)"

View solution in original post

0 Karma

Influencer

You can extract the name as below

[sourcetype_X]
  EXTRACT-XYZ = username="(?<name>[^+\"]*)@"
0 Karma

Ultra Champion

Hi @pavanae
Try this:

[sourcetype_X]
EXTRACT-UVW = emailUser="(?<emailUser>[^\@]+)"

View solution in original post

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!