Splunk Search

how to extract a string before the @ symbol from an email adress?

pavanae
Builder

I have the username filed extraction as follows in the props.conf which extracts the email address:-

 [sourcetype_X]
 EXTRACT-XYZ = username="(?<user>[^+\"]*)"

which extracts the field as follows

 x12345@abc-def-ghij-01.com
 y67891@klm-def-ghij-01.com
 z45787@abc-def-ghij-01.com
 ABC-DEF

Now what would be regex stanza to extract the username as follows from the above

x12345
 y67891
 z45787
 ABC-DEF
0 Karma
1 Solution

nickhills
Ultra Champion

Hi @pavanae
Try this:

[sourcetype_X]
EXTRACT-UVW = emailUser="(?<emailUser>[^\@]+)"
If my comment helps, please give it a thumbs up!

View solution in original post

0 Karma

Vijeta
Influencer

You can extract the name as below

[sourcetype_X]
  EXTRACT-XYZ = username="(?<name>[^+\"]*)@"
0 Karma

nickhills
Ultra Champion

Hi @pavanae
Try this:

[sourcetype_X]
EXTRACT-UVW = emailUser="(?<emailUser>[^\@]+)"
If my comment helps, please give it a thumbs up!
0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...