Splunk Search

regex help

mcbradford
Contributor

Not the best regex king, so I need some help please

within the field "From" in my data there are emails. Within the emails there should never be a number before the @.

For example, mark1@mydamin.com is not valid, but mark@mydomain.com is valid.

I want to find all the non valid emails.

Tags (1)
0 Karma

skoelpin
SplunkTrust
SplunkTrust

Try this..

If you want to get good with regex then go to www.regex101.com and put some sample data in and test it

This will find all emails with a number before the @ symbol

\w+\d@\w+\.com

index=foo ... | rex (?P<Bad_Email>\w+\d@\w+\.com)

0 Karma

sundareshr
Legend

Try this

.... | rex "(.*\d.*?@[^\s]+)" | ...
0 Karma

somesoni2
Revered Legend

Try like this

your base search | regex From="\S+\d\@\S+"
0 Karma
Get Updates on the Splunk Community!

Community Content Calendar, November Edition

Welcome to the November edition of our Community Spotlight! Each month, we dive into the Splunk Community to ...

October Community Champions: A Shoutout to Our Contributors!

As October comes to a close, we want to take a moment to celebrate the people who make the Splunk Community ...

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...