I have the following string:
"userEmail":"someString/[email protected]" ABC DEF,
"userAddress":"otherString/[email protected]" HIG KLM,
"userEmail":"someOtherString/[email protected]" ABC DEF,
from which I want to extract the "ab-cde-fgh-2020.domain.com" part but only from the "userEmail" tag.
The regex on regex101 works,
however on Splunk Search trying to use the expression:
| rex "(?<user>(?<="\"userEmail"\"\:\".*)(?<=\/)(.*?)(?=\@))"
it gives me the error that "lookbehind assestions is not fixed length", while the following:
| rex "(?<user>(?<=\"userEmail"\"\:\").*(?<=\/)(.*?)(?=\@))"
Returns:
someString/ab-cde-fgh-2020.domain.com
someOtherString/ab-cde-fgh-2020.domain.com
as one would expect. However the strings in the position of "someString" or "someOtherString" could be of any length in my data. What could be a workaround on that issue?
