Splunk Search

regex help

mcbradford
Contributor

Not the best regex king, so I need some help please

within the field "From" in my data there are emails. Within the emails there should never be a number before the @.

For example, [email protected] is not valid, but [email protected] is valid.

I want to find all the non valid emails.

Tags (1)
0 Karma

skoelpin
SplunkTrust
SplunkTrust

Try this..

If you want to get good with regex then go to www.regex101.com and put some sample data in and test it

This will find all emails with a number before the @ symbol

\w+\d@\w+\.com

index=foo ... | rex (?P<Bad_Email>\w+\d@\w+\.com)

0 Karma

sundareshr
Legend

Try this

.... | rex "(.*\d.*?@[^\s]+)" | ...
0 Karma

somesoni2
Revered Legend

Try like this

your base search | regex From="\S+\d\@\S+"
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Laser Bananas and Edge Hubs: Exploring Operational Technology (OT) Data Through a ...

  OT is a different environment to traditional IT and can have interesting challenges when interfacing the ...

Event Series: Mastering AI Tokenomics and Splunk Agent Observability

Beyond the Black Box: Correlating AI Performance and Tokenomics with Splunk Agent Observability   As ...

span_metrics: The OpenTelemetry-Idiomatic Way to See Inside Your Services

You open a trace in Splunk Observability Cloud and everything looks fine. One root span, order-pipeline, with ...