Please help me in forming Regex.

[ansif]

Hi All,

Please help me to extract the email ids which is not between <> angle brackets.

Sample event:

someone@domain.com,someone1@domain.com,someone2@domain.com,someone3@domain.com,

Not able to include a mail id between angle brackets.So consider a mail id is there in the above list between <> angle brackets.

Expected output:

someone@domain.com,someone1@domain.com,someone2@domain.com,someone3@domain.com,

The Regex:

([A-z0-9._%+-]+@[A-z0-9.-]+.[A-z]{2,63}) this extracts all email ids.

[DalJeanis]

Try this -

| rex field=myfield "\<?(<MyEmail>[A-z0-9._%+-]+@[A-z0-9.-]+.[A-z]{2,63})\>?(,|$)" max_match=0  

That should extract each email to a multi-value field, leaving out the angle brackets.

[niketn]

@DalJeanis, while this should be confirmed by @ansif, I think his original query was already extracting emails correctly even if it was within angular brackets. I think what Ansif required was angular brackets to be included in the extraction not excluded. But due to the omissions in his post requirement is not quite clear. We can wait for him to respond back.

[DalJeanis]

That would be this...

| rex field=myfield "(<MyEmail>\<?[A-z0-9._%+-]+@[A-z0-9.-]+.[A-z]{2,63}\>?)(,|$)" max_match=0 

[ansif]

Thanks Niket and Dal.

I need to exclude mail ids which is surrounded with angle brackets.like Ansif.d@splunk.com and thirich.89@splunk.com should be extracted in the below sample:

Ansif.d@splunk.com thirich.89@splunk.com

[DalJeanis]

Then that would be this

| rex field=myfield "(?<![A-z0-9._%+-\<])(<MyEmail>\<?[A-z0-9._%+-]+@[A-z0-9.-]+.[A-z]{2,63})(,|$)" max_match=0 

This little beauty (?<![A-z0-9._%+-\<]) is a negative lookback that translates as
" (?<! that is not preceded by [A-z0-9._%+-\<] any of the listed characters (including <)"

You can't use just (?<!\<) to eliminate the open bracket because that would just drop the first character of the email address and take up extracting from the second one.

You don't have to check for the close bracket at the end, because that address will already have been eliminated by not having anything before the @ sign.

[ansif]

Not able to include a sample mail IDs with angle brackets

[niketn]

Ansif, you can use code button (one with 101010) to escape special characters. I hope following is the question you intended to ask.

someone@domain.com,someone1@domain.com,<someone2@domain.com>,someone3@domain.com,

So should your output also have angular bracket when you extract email?

([<A-z0-9._%+-]+@[A-z0-9.-]+.[A-z>]{2,63})