regex expression look behind issue

[constantinetamp]

I have the following string:

 "userEmail":"someString/[email protected]" ABC DEF, 
 "userAddress":"otherString/[email protected]" HIG KLM,
 "userEmail":"someOtherString/[email protected]" ABC DEF, 

from which I want to extract the "ab-cde-fgh-2020.domain.com" part but only from the "userEmail" tag.

The regex on regex101 works,

regex.PNG

however on Splunk Search trying to use the expression:

| rex "(?<user>(?<="\"userEmail"\"\:\".*)(?<=\/)(.*?)(?=\@))"

it gives me the error that "lookbehind assestions is not fixed length", while the following:

| rex "(?<user>(?<=\"userEmail"\"\:\").*(?<=\/)(.*?)(?=\@))"

Returns:

someString/ab-cde-fgh-2020.domain.com
someOtherString/ab-cde-fgh-2020.domain.com

as one would expect. However the strings in the position of "someString" or "someOtherString" could be of any length in my data. What could be a workaround on that issue?

[richgalloway]

Try this rex command that doesn't use lookbehind.

| rex "userEmail[^\/]+(?<user>[^@]+)"