Hi @DavideASR, please try this, | rex "@(?<domain>[^\<]+)" that you can test at https://regex101.com/r/Bffr7q/1  if you have the above value in another field (e.g. email), you could use | rex field=email "@(?<domain>[^\<]+)" Ciao. Giuseppe ... View more

To extract the email address from the from field, use the rex command. | rex field=from "\<(?<fuser>[^>]+)"   ... View more