Splunk Regex Email Expression

Question

When attempting to create e-mail alerts within our Splunk> server (Version 4.3 for those who care) we receive an e-mail invalid error message which I have traced back to the restmap.conf file. The current expression is:

validate( match('action.email.to', "(?i)^(?:[^@\s]+@(?:[^@\s.]+\.)+[a-z]{2,})(?:\s*[,;]\s*(?:[^@\s]+@(?:[^@\s]+\.)+[a-z]{2,}))*$"), "One of the email addresses in 'action.email.to' is invalid")

I am not good at regex at all and this one seems to be rather complex. I want the expression to allow e-mail address such as john.smith@abc.p1 I attempted to create or modify the current regex using http://regex101.com/#PCRE but this is a little over my head still.

Answer 1

Ok, the current regex is this:

(?i)^(?:[^@\s]+@(?:[^@\s.]+\.)+[a-z]{2,})(?:\s*[,;]\s*(?:[^@\s]+@(?:[^@\s]+\.)+[a-z]{2,}))*$

It is failing to match john.smith@abc.p1 because there is a number(1) in the .p1 part of the email.

So in your regex.., in this part: [a-z]{2,}. You just need to allow for a 1 or the whole number set 0-9 like so: [a-z0-9]{2,} or [a-z1]{2,}

So this is the your full regex, modified to work for your situation:

(?i)^(?:[^@\s]+@(?:[^@\s.]+\.)+[a-z0-9]{2,})(?:\s*[,;]\s*(?:[^@\s]+@(?:[^@\s]+\.)+[a-z0-9]{2,}))*$

Working regex example:

http://regex101.com/r/lX7yM5