Splunk Search

simple email regex

kleckns
Explorer

Ive been trying most of the regex solutions on this forum, but cant get any of them to work. Im trying to extract emails into a new field without any of the extra junk

field value needs regex:
 "John Doe" <john.doe@somedomain.tld>

search:
    ... | rex field=from "(?<from>(?<=<)[^>]+)" | table from, other fields, etc...

im looking for john.doe@somedomain.tld without any quotes or gt/lt characters around it in the from field

Tags (2)
0 Karma
1 Solution

somesoni2
Revered Legend

This should do it.

... | rex field=from "(\<|\;)(?<from>[^\>\;]+)" | table from, other fields, etc...

View solution in original post

somesoni2
Revered Legend

This should do it.

... | rex field=from "(\<|\;)(?<from>[^\>\;]+)" | table from, other fields, etc...

kleckns
Explorer

your regex worked great. Part of the problem was a dumb mistake on my part. i had switched the fields around in the field=email_from "(<|\;)(?[^>\;]+)"

the orig field that had the values is email_from, not from. i wanted to create a new field called from... so i had it backwards.

Thank you for the regex!

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...