Hello,
I cannot figure out the syntax of the rex function. I have a field called data multiple email addresses: eample@blahblah.com. ODY=7BIT
I need to create a new field where just @blabla.com without the rest of data from the begining or the ending of the filed.
Like this:
... | rex field=data "^[^@]*@(?<capture>[^\.]+)"
Hi
It looks duplicate of https://answers.splunk.com/answers/740822/sub-a-string-until-a-specific-character.html#answer-740924