Splunk Search

How to Trim string at @ - need help creating rex search

katzr
Path Finder

Hello,

I cannot figure out the syntax of the rex function. I have a field called email with multiple domains: katz.r@blah.com example@blahblah.com. I need to create a new field where just katz.r and example are returned- so it is cut off at the @ sign. I cannot figure out the syntax of rex to write it and the split function keeps both the values: katz.r and blah.com-which is not what I want. I also tried rtim but I that isn't working for a field- just a given string.

Thanks for the help!

0 Karma
1 Solution

cpetterborg
SplunkTrust
SplunkTrust

So if you just want to isolate the username from the domain in the email field into a new field (I'm using user), you can do that something like this:

... | eval user=email | rex field=user mode=sed "s/@\S+//g"

View solution in original post

niketn
Legend

@katzr, Similar question was asked a day before... https://answers.splunk.com/answers/569242/having-difficulties-at-search-trying-to-use-sed-to.html. @cpetterborg, with accepted answer to that question, has already answered here with his accepted answer using sed, following is rex on similar lines but without sed:

 | makeresults
 | eval _raw="user@domain.com" 
 | rex "(?<user>[^@]+)@"
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

cpetterborg
SplunkTrust
SplunkTrust

So if you just want to isolate the username from the domain in the email field into a new field (I'm using user), you can do that something like this:

... | eval user=email | rex field=user mode=sed "s/@\S+//g"

s2_splunk
Splunk Employee
Splunk Employee
| makeresults | eval email="anybody@mail.com" | rex field=email "^(?<firstPart>.*)@" | table email, firstPart

I am assuming your events have a field called 'email' with just one value per event, but across events there are multiple values.
If your email field contains multiple email addresses in each event, the approach would be different. So please clarify, if this is not what you need.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi
why do you want to use regex?
try using makemv and mvexpand, something like this
index=_internal | head 1| eval IP="katz.r@blah.com example@blahblah.com" | makemv IP | mvexpand IP | table IP
Bye.
Giuseppe

0 Karma

katzr
Path Finder

I need to perform this action for the whole field email- not just those example strings

0 Karma

gcusello
SplunkTrust
SplunkTrust

Could you share an example to extract fields?
Bye.
Giuseppe

0 Karma

katzr
Path Finder

The field is called email and contains values of a typical email. And I want a new field that just includes the portion of the email string before the @.

So katz.r@blahblah.com is a value in the field Email. And I want just katz.r in a new field.

0 Karma

katzr
Path Finder

Thanks for help!

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...