Extracting email address from raw events with different formats

[Will_powr]

Good Day Splunkers! I've been banging me my trying to capture all email address as recipients. Is this even possible? 

"status":"delivered":"recipient":"some.name@mail.com":"subject":"Thank you!":"

"status":"delivered":"recipient":"some.middle.name@mail.com":"subject":"Thank you!":"

"status":"delivered":"recipient":"\"Name Some \"<some.name@mail.com>":"subject":"Thank you!":"

"status":"delivered":"recipient":"some.name@mail.com,  another.name@mail.com,  more.names@mail.com subject":"Thank you!":"

"recipient":"\"different.name@mail.com\" <different.name@mail.com>, \"same.name@mail.com\"<same.name@mail.com>":"subject":"Thank you!":"

[gcusello]

Hi @Will_powr,

having you so different formats, you could try using this regex

| rex "(?<mail>(\w+\.)*\w+@\w+\.\w+)"

that probably extract too many values.

Otherwise, you could use more regexes for each format:

| rex "\"(?<mail>(\w+\.)*\w+@\w+\.\w+)"
| rex "\<(?<mail>(\w+\.)*\w+@\w+\.\w+)\>"

that you can test at

https://regex101.com/r/fP9DAo/1

Ciao.

Giuseppe

[inventsekar]

Hi @Will_powr ... may we know, if you are trying to do this with SPL Rex search query

or

while log ingestion itself you would like to extract the email address, please suggest, thanks.