<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: If statement wild card in Reporting</title>
    <link>https://community.splunk.com/t5/Reporting/If-statement-wild-card/m-p/399108#M9978</link>
    <description>&lt;P&gt;Thanks, got it&lt;/P&gt;</description>
    <pubDate>Sun, 17 Feb 2019 22:04:00 GMT</pubDate>
    <dc:creator>sumitkathpal292</dc:creator>
    <dc:date>2019-02-17T22:04:00Z</dc:date>
    <item>
      <title>If statement wild card</title>
      <link>https://community.splunk.com/t5/Reporting/If-statement-wild-card/m-p/399105#M9975</link>
      <description>&lt;P&gt;Hi All,&lt;/P&gt;

&lt;P&gt;we need to define internal and external email segregation, we have the field sender and receiver fields . If sender equals &lt;CODE&gt;*@hello.com&lt;/CODE&gt; and receiver equals &lt;CODE&gt;*@hello.com&lt;/CODE&gt; than mark as internal all others external.&lt;/P&gt;

&lt;P&gt;Currently i did &lt;CODE&gt;if(sender=="*@hello.com" AND receiver=="*@hello.com.au","internal","external")&lt;/CODE&gt; but unsuccessful .&lt;/P&gt;

&lt;P&gt;Any help?&lt;/P&gt;</description>
      <pubDate>Sun, 17 Feb 2019 06:23:42 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Reporting/If-statement-wild-card/m-p/399105#M9975</guid>
      <dc:creator>sumitkathpal292</dc:creator>
      <dc:date>2019-02-17T06:23:42Z</dc:date>
    </item>
    <item>
      <title>Re: If statement wild card</title>
      <link>https://community.splunk.com/t5/Reporting/If-statement-wild-card/m-p/399106#M9976</link>
      <description>&lt;P&gt;&lt;CODE&gt;eval&lt;/CODE&gt; and &lt;CODE&gt;where&lt;/CODE&gt; treat &lt;CODE&gt;*&lt;/CODE&gt; as a literal character, not a wildcard. Use &lt;CODE&gt;match()&lt;/CODE&gt;.&lt;/P&gt;</description>
      <pubDate>Sun, 17 Feb 2019 11:08:42 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Reporting/If-statement-wild-card/m-p/399106#M9976</guid>
      <dc:creator>martin_mueller</dc:creator>
      <dc:date>2019-02-17T11:08:42Z</dc:date>
    </item>
    <item>
      <title>Re: If statement wild card</title>
      <link>https://community.splunk.com/t5/Reporting/If-statement-wild-card/m-p/399107#M9977</link>
      <description>&lt;P&gt;HI @sumitkathpal2929&lt;/P&gt;

&lt;P&gt;Try this,&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;| makeresults 
| eval sender ="test@hello.com",receiver="test1@hello.com" 
| eval result = if(match(sender,".*@hello\.com") AND match(receiver,".*@hello\.com"),"internal","external")
&lt;/CODE&gt;&lt;/PRE&gt;</description>
      <pubDate>Sun, 17 Feb 2019 11:41:36 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Reporting/If-statement-wild-card/m-p/399107#M9977</guid>
      <dc:creator>vnravikumar</dc:creator>
      <dc:date>2019-02-17T11:41:36Z</dc:date>
    </item>
    <item>
      <title>Re: If statement wild card</title>
      <link>https://community.splunk.com/t5/Reporting/If-statement-wild-card/m-p/399108#M9978</link>
      <description>&lt;P&gt;Thanks, got it&lt;/P&gt;</description>
      <pubDate>Sun, 17 Feb 2019 22:04:00 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Reporting/If-statement-wild-card/m-p/399108#M9978</guid>
      <dc:creator>sumitkathpal292</dc:creator>
      <dc:date>2019-02-17T22:04:00Z</dc:date>
    </item>
    <item>
      <title>Re: If statement wild card</title>
      <link>https://community.splunk.com/t5/Reporting/If-statement-wild-card/m-p/399109#M9979</link>
      <description>&lt;P&gt;... except in &lt;CODE&gt;tsats&lt;/CODE&gt;.&lt;/P&gt;</description>
      <pubDate>Fri, 08 Mar 2019 03:20:03 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Reporting/If-statement-wild-card/m-p/399109#M9979</guid>
      <dc:creator>woodcock</dc:creator>
      <dc:date>2019-03-08T03:20:03Z</dc:date>
    </item>
    <item>
      <title>Re: If statement wild card</title>
      <link>https://community.splunk.com/t5/Reporting/If-statement-wild-card/m-p/399110#M9980</link>
      <description>&lt;P&gt;&lt;CODE&gt;eval&lt;/CODE&gt; and &lt;CODE&gt;where&lt;/CODE&gt; &lt;EM&gt;commands&lt;/EM&gt;.&lt;/P&gt;</description>
      <pubDate>Fri, 08 Mar 2019 06:30:52 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Reporting/If-statement-wild-card/m-p/399110#M9980</guid>
      <dc:creator>martin_mueller</dc:creator>
      <dc:date>2019-03-08T06:30:52Z</dc:date>
    </item>
  </channel>
</rss>

