Splunk Search
Highlighted

strip portion of an email

Explorer

I am needing to strip a portion out of email's. I have a list of email addresses where some of them contain -priv before the @ that I need stripped out leaving what would be the "normal" email address.

example address
example-priv@email.com

I want to be left with example@email.com

can someone help me with the rex for this?

thank you

0 Karma
Highlighted

Re: strip portion of an email

Esteemed Legend

Like this:

| makeresults 
| eval email="example-priv@email.com" 
| rex field=email mode=sed "s/-[^@]+@/@/g"
0 Karma
Highlighted

Re: strip portion of an email

Explorer

Thank you, I should add that I have since noticed that there are email addresses that have an appropriate need to have - in them.

example
surname.givenname-middlename-priv@email.com

so I really need to only strip emails that have -priv in them, not any email that contains a - from the - to @

0 Karma
Highlighted

Re: strip portion of an email

SplunkTrust
SplunkTrust

Try | rex field=email mode=sed "s/-priv//"

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

Highlighted

Re: strip portion of an email

Explorer

Thank you, this worked

0 Karma