-2

I Need to know to subtract a string from the begining of a value until a specific character in Spl. For example, if I have a field who contains emails or another data:

MAIL FROM: YYYY@XXXXX.com BODY=7BIT

How to get just the email address YYYY@XXXXX.com

Thanks for the help.

Anas Salem
  • 177
  • 1
  • 2
  • 13

1 Answers1

1

The best approach here would be to use a regular expression.

| rex field=_raw "(?<email>\S+@\S+)"

Simon Duff
  • 2,631
  • 2
  • 7
  • 15