I have the following string:
"userEmail":"someString/ab-cde-fgh-2020.domain.com@DOMAIN.COM" ABC DEF,
"userAddress":"otherString/ig-klm-nop-2020.domain.com@DOMAIN.COM" HIG KLM,
"userEmail":"someOtherString/ab-cde-fgh-2020.domain.com@DOMAIN.COM" ABC DEF,
from which I want to extract the "ab-cde-fgh-2020.domain.com" part but only from the "userEmail" tag.
The regex on regex101 works,
however on Splunk Search trying to use the expression:
| rex "(?<user>(?<="\"userEmail"\"\:\".*)(?<=\/)(.*?)(?=\@))"
it gives me the error that "lookbehind assestions is not fixed length", while the following:
| rex "(?<user>(?<=\"userEmail"\"\:\").*(?<=\/)(.*?)(?=\@))"
Returns:
someString/ab-cde-fgh-2020.domain.com
someOtherString/ab-cde-fgh-2020.domain.com
as one would expect. However the strings in the position of "someString" or "someOtherString" could be of any length in my data. What could be a workaround on that issue?
Try this rex command that doesn't use lookbehind.
| rex "userEmail[^\/]+(?<user>[^@]+)"