I have the following string: "userEmail":"someString/ab-cde-fgh-2020.domain.com@DOMAIN.COM" ABC DEF,
"userAddress":"otherString/ig-klm-nop-2020.domain.com@DOMAIN.COM" HIG KLM,
"userEmail":"someOtherString/ab-cde-fgh-2020.domain.com@DOMAIN.COM" ABC DEF, from which I want to extract the "ab-cde-fgh-2020.domain.com" part but only from the "userEmail" tag. The regex on regex101 works, however on Splunk Search trying to use the expression: | rex "(?<user>(?<="\"userEmail"\"\:\".*)(?<=\/)(.*?)(?=\@))" it gives me the error that "lookbehind assestions is not fixed length", while the following: | rex "(?<user>(?<=\"userEmail"\"\:\").*(?<=\/)(.*?)(?=\@))" Returns: someString/ab-cde-fgh-2020.domain.com
someOtherString/ab-cde-fgh-2020.domain.com as one would expect. However the strings in the position of "someString" or "someOtherString" could be of any length in my data. What could be a workaround on that issue?
... View more