What does (?i) and ?@ in this regex mean

regex splunk
Deesbek picture Deesbek · Apr 9, 2014 · Viewed 42.4k times · Source

In the following regex what does "(?i)" and "?@" mean?

(?i)<.*?@(?P<domain>\w+\.\w+)(?=>)

I know that "?" means zero or one and that i sets case insensitivity.

This regex captures domains from an email address in a mailto field, but does not include the @ sign. It was generated the erex command from within SPLUNK 6.0.2

Answer

aelor picture aelor · Apr 9, 2014

demo here : https://regex101.com/r/hE9gB4/1

(?i)<.*?@(?P<domain>\w+\.\w+)(?=>)

its actually getting your domain name from the email id:

(?i) makes it match case insensitive and

?@ is nothing but @ which matches the character @ literally.

the ? in your ?@ is part of .*? which we call as a lazy operator, It will give you the text between the < and @

if you dont use the ? after the .* it will match everything after < to the end. ( we call this as the greedy operator)

Related questions

How to ignore a specific sub-string from Splunk query

Need some help to generate appropriate Spunk query. I am searching for this but could not come up with a solution. Currently, I want to ignore all error alerts that are generated for logs with only ev31=error; term. If …

Read More
Need to extract and re-format with RegEx

I'm using Splunk to parse some logs that have our "hub" and "comp" IDs embedded in them, down in the body of the message. I need to use a field extraction RegEx to pull them out in the form: HHHH-CCCC …

Read More
Regular expression to match a line that doesn't contain a word

I know it's possible to match a word and then reverse the matches using other tools (e.g. grep -v). However, is it possible to match lines that do not contain a specific word, e.g. hede, using a regular …

Read More