Splunk Search

strip portion of an email

brownt61
Explorer

I am needing to strip a portion out of email's. I have a list of email addresses where some of them contain -priv before the @ that I need stripped out leaving what would be the "normal" email address.

example address
example-priv@email.com

I want to be left with example@email.com

can someone help me with the rex for this?

thank you

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Try | rex field=email mode=sed "s/-priv//"

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Try | rex field=email mode=sed "s/-priv//"

---
If this reply helps you, Karma would be appreciated.

brownt61
Explorer

Thank you, this worked

0 Karma

woodcock
Esteemed Legend

Like this:

| makeresults 
| eval email="example-priv@email.com" 
| rex field=email mode=sed "s/-[^@]+@/@/g"
0 Karma

brownt61
Explorer

Thank you, I should add that I have since noticed that there are email addresses that have an appropriate need to have - in them.

example
surname.givenname-middlename-priv@email.com

so I really need to only strip emails that have -priv in them, not any email that contains a - from the - to @

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...