Splunk Search

simple email regex

kleckns
Explorer

Ive been trying most of the regex solutions on this forum, but cant get any of them to work. Im trying to extract emails into a new field without any of the extra junk

field value needs regex:
 "John Doe" <john.doe@somedomain.tld>

search:
    ... | rex field=from "(?<from>(?<=<)[^>]+)" | table from, other fields, etc...

im looking for john.doe@somedomain.tld without any quotes or gt/lt characters around it in the from field

Tags (2)
0 Karma
1 Solution

somesoni2
Revered Legend

This should do it.

... | rex field=from "(\<|\;)(?<from>[^\>\;]+)" | table from, other fields, etc...

View solution in original post

somesoni2
Revered Legend

This should do it.

... | rex field=from "(\<|\;)(?<from>[^\>\;]+)" | table from, other fields, etc...

View solution in original post

kleckns
Explorer

your regex worked great. Part of the problem was a dumb mistake on my part. i had switched the fields around in the field=email_from "(<|\;)(?[^>\;]+)"

the orig field that had the values is email_from, not from. i wanted to create a new field called from... so i had it backwards.

Thank you for the regex!

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!