Reporting

Email strip

debabratp
New Member

In my log file there is a uid/ email field. The splunk search should not display/ignore result if the email domain is for example google, yahoo. Splunk should display result associated with mydomain.

If thelog have ..... uid = myname@mydomain.com.......uid = myname@gmail.com...... uid= mail@yahoo.com..... uid = mail@aol.com......uid=null

The splunk search should spit out uid = myname@mydomain.com. How to do this? Help! help!

Tags (1)
0 Karma
1 Solution

gfuente
Motivator

Hello

First, if you havent done it yet, you need to extract the email field. Using the regex command, for example:

..| regex "(?<email>[a-zA-Z0-9]+@[a-zA-Z0-9]+\.[a-zA-Z0-9]+)" | ...

Then you need to filter the results with

..| search email="*@mydomain.com" | ...

Regards

View solution in original post

gfuente
Motivator

Hello

First, if you havent done it yet, you need to extract the email field. Using the regex command, for example:

..| regex "(?<email>[a-zA-Z0-9]+@[a-zA-Z0-9]+\.[a-zA-Z0-9]+)" | ...

Then you need to filter the results with

..| search email="*@mydomain.com" | ...

Regards

debabratp
New Member

Thanks for your regx to extract only the email. Your answer is perfect. But I asked the question differently. My bad. It helped.

But how do i use it in Dashboard? Do i need to have escape character for (?...

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...