Splunk Search

how to extract partial value from filed and show as column

New Member

Hi , Im trying to extract distinct email is as column and preparing some counts .For this im thinking to extract the email data from log field . Can someone please provide pointers

"log": " \u001b[2m2023-08-09 21:28:28.347\u001b[0;39m \u001b[32mDEBUG\u001b[0;39m \u001b[35m1\u001b[0;39m \u001b[2m---\u001b[0;39m \u001b[2m[nio-8080-exec-7]\u001b[0;39m \u001b[36ms.s.w.c.SecurityContextPersistenceFilter\u001b[0;39m \u001b[2m:\u001b[0;39m Set SecurityContextHolder to SecurityContextImpl [Authentication= SCOPE_profile1]], User Attributes: [{ email=venkatanaresh.mokka@one.verizon.com}], Credentials=[PROTECTED] ]]\n",
"stream": "stdout",

"kubernetes": {
"container_name": "draftx-ui-gateway",

Labels (3)
0 Karma


You must have a field name log.  Use extract (aka kv) on it.

| rename log as _raw 
| kv


Tags (1)
0 Karma



as usual there is another way too 😉 I'm expecting that this information is on field called "log". If it's something else then just change field=<your field name>

| rex field=log "email=(?<email>[^}]+)"

You could check by Job Inspector which one is better on your case.

r. Ismo 

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...