How to Standardize email to output "First Last" to a new field?

[migullmills]

I am having issue finding a way to standardize email for a query that will make the output "First Last" to a new field. 

there are mainly two email types in "first.x.last@domain.com" or "first.last@domain.com"

The first works for "first.x.last@domain.com": 

| makeresults
| eval name="first.x.last@domain.com"
| rex field=name "^(?<Name>[^@]+)"
| eval tmp=split(Name,".")
| eval tmp2=split(Name,".")
| eval FullName=mvindex(tmp,0) | eval FName=mvindex(tmp2,2) | table FullName FName | eval newName=mvappend(FullName,FName) | eval FN=mvjoin(newName, " ")
| table FN 

And this for "first.last@domain.com"

| makeresults
| eval name="first.last@domain.com"
| rex field=name "^(?<Name>[^@]+)"
| eval tmp=split(Name,".") | eval FullName=mvindex(tmp,0,1) | eval FN=mvjoin(FullName, " ")
| table FN


Any recommendations of how to accomplish getting an output of "First Last" to one field for both email types? 

[richgalloway · Accepted solution]

This rex command will extract first and last names from both formats.

| rex "(?<first>[^\.]+)\.(?:\w\.)?(?<last>[^@]+)"
| eval FullName = first . " " . last

[migullmills]

This worked, I couldn't get the regex right. 

I was using to pass as a subsearch so the only thing I need was to add the "quotes" around it. So I did a mvindex and added format on the end. 

Thank you!

[yuanliu]

If the end goal just to combine the assumed first and last with a space, why not just do that literally?  Like

| eval name = split(mvindex(split(name, "@"), 0), ".")
| eval FN = mvindex(name, 0) . " " . mvindex(name, -1)

Here is an emulation that you can run and compare with real data

| makeresults
| eval name=mvappend("first1.x.last1@domain.com", "first2.last2@domain.com")
| mvexpand name
``` data emulation above ```

 The output is something like

FN	name
first1 last1	first1 x last1
first2 last2	first2 last2