Splunk Search

regex to extract field

numeroinconnu12
Path Finder

Hello,

This is my character string user=YHYIFLP@intra.bcg.local i want to display just YHYIFLP, i use
| eval user=trim(user, "@intra.bcg.local") he doesn't work verry well. it's possible to use regex?

Thanks.

0 Karma
1 Solution

javiergn
Super Champion

Simplest regex you can use could be this:

| rex field=user "^(?<justUser>[^\@]+)"

Which will extract just the user from the field user into a new field named justUser.

A more accurate and faster regex would be something like https://www.regextester.com/19

Hope that helps,
J

View solution in original post

0 Karma

numeroinconnu12
Path Finder

Thanks you all,
it works

0 Karma

vnravikumar
Champion

Hi

Try this

| makeresults 
| eval user="YHYIFLP@intra.bcg.local" 
| rex field=user "(?P<user>^[^@]+)"

or

| makeresults 
| eval user="YHYIFLP@intra.bcg.local", result = mvindex(split(user,"@"),0)
0 Karma

jpolvino
Builder

Here is one way to do it

| makeresults 
| eval user="YHYIFLP@intra.bcg.local" 
| rex field=user "(?<username>[^@]+)@.*"
| table user username
0 Karma

javiergn
Super Champion

Simplest regex you can use could be this:

| rex field=user "^(?<justUser>[^\@]+)"

Which will extract just the user from the field user into a new field named justUser.

A more accurate and faster regex would be something like https://www.regextester.com/19

Hope that helps,
J

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...