https://community.splunk.com/t5/Splunk-Search/Adding-email-domain-to-values/m-p/569751#M198577 <P>You can do something like this</P><LI-CODE lang="markup">Your base search with field say "username" | eval username=if(match(username,"splunk.com$"),username,username."@splunk.com")</LI-CODE> Tue, 05 Oct 2021 18:00:20 GMT somesoni2 2021-10-05T18:00:20Z https://community.splunk.com/t5/Splunk-Search/Adding-email-domain-to-values/m-p/569741#M198572 <P>I have a field, let's say the user field, that has both usernames without a domain and some with.</P><P>I want the fields values that don't have an extension to have it added</P><P>&nbsp;</P><P>Example:</P><P>sparky1</P><P><A href="mailto:sparky2@splunk.com" target="_blank" rel="noopener">sparky2@splunk.com</A></P><P>&nbsp;</P><P>I want to be able to append splunk.com to the sparky1 value, without adding it again to sparky2@splunk.com</P> Tue, 05 Oct 2021 17:21:49 GMT https://community.splunk.com/t5/Splunk-Search/Adding-email-domain-to-values/m-p/569741#M198572 Sparky1 2021-10-05T17:21:49Z https://community.splunk.com/t5/Splunk-Search/Adding-email-domain-to-values/m-p/569751#M198577 <P>You can do something like this</P><LI-CODE lang="markup">Your base search with field say "username" | eval username=if(match(username,"splunk.com$"),username,username."@splunk.com")</LI-CODE> Tue, 05 Oct 2021 18:00:20 GMT https://community.splunk.com/t5/Splunk-Search/Adding-email-domain-to-values/m-p/569751#M198577 somesoni2 2021-10-05T18:00:20Z https://community.splunk.com/t5/Splunk-Search/Adding-email-domain-to-values/m-p/569758#M198580 <P>That worked! Thanks</P> Tue, 05 Oct 2021 18:27:36 GMT https://community.splunk.com/t5/Splunk-Search/Adding-email-domain-to-values/m-p/569758#M198580 Sparky1 2021-10-05T18:27:36Z