Hi Splunkers,
I have been struggling to extract user name from below values of user.
user
--------
user1@sa.com
sab\user2
user3
OUTPUT
------------
user1
user2
user3
kindly help me out..
Give this a try. (Runanywhere sample search, first line is just to generate sample data).
| gentimes start=-1 | eval user="user1@sa.com sab\user2 user3" | table user | makemv user | mvexpand user
| rex field=user "(?<cleanedUser>\w+)(\@|$)"
Give this a try. (Runanywhere sample search, first line is just to generate sample data).
| gentimes start=-1 | eval user="user1@sa.com sab\user2 user3" | table user | makemv user | mvexpand user
| rex field=user "(?<cleanedUser>\w+)(\@|$)"
you are amazing @somesoni2
please explain regex Sir.
It's capturing a full work (\w+) till you encounter a @
symbol or end of value ($
). backward slash is word terminator so it works for 2nd example value as well.