Splunk Search

regex help

mcbradford
Contributor

Not the best regex king, so I need some help please

within the field "From" in my data there are emails. Within the emails there should never be a number before the @.

For example, mark1@mydamin.com is not valid, but mark@mydomain.com is valid.

I want to find all the non valid emails.

Tags (1)
0 Karma

skoelpin
SplunkTrust
SplunkTrust

Try this..

If you want to get good with regex then go to www.regex101.com and put some sample data in and test it

This will find all emails with a number before the @ symbol

\w+\d@\w+\.com

index=foo ... | rex (?P<Bad_Email>\w+\d@\w+\.com)

0 Karma

sundareshr
Legend

Try this

.... | rex "(.*\d.*?@[^\s]+)" | ...
0 Karma

somesoni2
Revered Legend

Try like this

your base search | regex From="\S+\d\@\S+"
0 Karma
Get Updates on the Splunk Community!

What the End of Support for Splunk Add-on Builder Means for You

Hello Splunk Community! We want to share an important update regarding the future of the Splunk Add-on Builder ...

Solve, Learn, Repeat: New Puzzle Channel Now Live

Welcome to the Splunk Puzzle PlaygroundIf you are anything like me, you love to solve problems, and what ...

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...