Splunk Search

How to extract a part of a field?

reschal
Explorer

Hey,

i have got a field extraction called mail. So i get different kind of mails as output.

But it appears the following problem: All the mail adresses have a "." at the end and i want to remove the ".".

For example: "xy.z@yahoo.com." shall be "xy.z@yahoo.com"

I tried to solve the problem by extracting the expression without the "." but it won't work.

|rex field=mail "(?<mail>[\s]+)-."

Thanks for your help!

Tags (1)
0 Karma
1 Solution

mayurr98
Super Champion

Try this

| rex field=mail "(?P<mail>[^\s]+)\."

Let me know if it helps!

View solution in original post

0 Karma

Yunagi
Communicator

If you really want to change the field with a Splunk search, then try the following:

| eval mail=substr(mail,0,len(mail)-1)

However, I think the better approach is to improve the actual field extraction. Can you provide the field extraction under Settings/Fields/Field extractions?

0 Karma

mayurr98
Super Champion

Try this

| rex field=mail "(?P<mail>[^\s]+)\."

Let me know if it helps!

0 Karma

reschal
Explorer

It works. Thanks very much 🙂

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...