regex to extract field

[numeroinconnu12]

Hello,

This is my character string user=YHYIFLP@intra.bcg.local i want to display just YHYIFLP, i use
| eval user=trim(user, "@intra.bcg.local") he doesn't work verry well. it's possible to use regex?

Thanks.

[numeroinconnu12]

Thanks you all,
it works

[vnravikumar]

Hi

Try this

| makeresults 
| eval user="YHYIFLP@intra.bcg.local" 
| rex field=user "(?P<user>^[^@]+)"

or

| makeresults 
| eval user="YHYIFLP@intra.bcg.local", result = mvindex(split(user,"@"),0)

[jpolvino]

Here is one way to do it

| makeresults 
| eval user="YHYIFLP@intra.bcg.local" 
| rex field=user "(?<username>[^@]+)@.*"
| table user username

[javiergn · Accepted solution]

Simplest regex you can use could be this:

| rex field=user "^(?<justUser>[^\@]+)"

Which will extract just the user from the field user into a new field named justUser.

A more accurate and faster regex would be something like https://www.regextester.com/19

Hope that helps,
J