https://community.splunk.com/t5/Splunk-Search/rex-n-replace-or-rex-and-optional-find/m-p/165716#M186072 <P>cs_username field contains multiple formats of username in the form of:<BR /> username<BR /> domain\usernam<BR /> <A href="mailto:username@domain.com">username@domain.com</A></P> <P>Q #1 How to I remove domain\ or @domian.com elegantly</P> <P>&amp;</P> <P>Q #2 How do I deduplicate those usernames that have different case sensitivies<BR /> username<BR /> USERNAME</P> <P>I just want one list of usernames to pipe back into a subsearch</P> <P>Driving me crazy.</P> Thu, 16 Oct 2014 21:14:15 GMT TobiasBoone 2014-10-16T21:14:15Z https://community.splunk.com/t5/Splunk-Search/rex-n-replace-or-rex-and-optional-find/m-p/165716#M186072 <P>cs_username field contains multiple formats of username in the form of:<BR /> username<BR /> domain\usernam<BR /> <A href="mailto:username@domain.com">username@domain.com</A></P> <P>Q #1 How to I remove domain\ or @domian.com elegantly</P> <P>&amp;</P> <P>Q #2 How do I deduplicate those usernames that have different case sensitivies<BR /> username<BR /> USERNAME</P> <P>I just want one list of usernames to pipe back into a subsearch</P> <P>Driving me crazy.</P> Thu, 16 Oct 2014 21:14:15 GMT https://community.splunk.com/t5/Splunk-Search/rex-n-replace-or-rex-and-optional-find/m-p/165716#M186072 TobiasBoone 2014-10-16T21:14:15Z https://community.splunk.com/t5/Splunk-Search/rex-n-replace-or-rex-and-optional-find/m-p/165717#M186073 <P>Something like this?</P> <PRE><CODE>main search foo [subsearch foo | eval username = lower(replace(username, "@.*", "")) | dedup username | fields username] </CODE></PRE> <P>Removes everything after an @ symbol, converts to lower case, dedups, builds a huge OR'd expression to filter the main search.</P> Thu, 16 Oct 2014 22:05:11 GMT https://community.splunk.com/t5/Splunk-Search/rex-n-replace-or-rex-and-optional-find/m-p/165717#M186073 martin_mueller 2014-10-16T22:05:11Z https://community.splunk.com/t5/Splunk-Search/rex-n-replace-or-rex-and-optional-find/m-p/165718#M186074 <P>I wasn't using eval in conjunction with the replace command correctly <span class="lia-unicode-emoji" title=":disappointed_face:">😞</span></P> <P>This example with another pipe to eval to get rid of the domain\ seems to be doing the trick. Thank you SO much.</P> Mon, 20 Oct 2014 19:27:04 GMT https://community.splunk.com/t5/Splunk-Search/rex-n-replace-or-rex-and-optional-find/m-p/165718#M186074 TobiasBoone 2014-10-20T19:27:04Z https://community.splunk.com/t5/Splunk-Search/rex-n-replace-or-rex-and-optional-find/m-p/165719#M186075 <P>Does that mean your question is solved?</P> Mon, 20 Oct 2014 22:36:18 GMT https://community.splunk.com/t5/Splunk-Search/rex-n-replace-or-rex-and-optional-find/m-p/165719#M186075 martin_mueller 2014-10-20T22:36:18Z