https://community.splunk.com/t5/Splunk-Search/Could-you-please-help-me-with-using-REX-REGEX-inside-eval/m-p/593147#M206451 <P>Given that the only time you change user is if signature is 87347 and in that instance you want everything before the&nbsp;@, just use split</P><LI-CODE lang="markup">| eval account=if(like(signature,"87347"),mvindex(split(user,"@"),0),user)</LI-CODE> Fri, 08 Apr 2022 17:36:54 GMT ITWhisperer 2022-04-08T17:36:54Z https://community.splunk.com/t5/Splunk-Search/Could-you-please-help-me-with-using-REX-REGEX-inside-eval/m-p/593132#M206447 <P>Hi</P> <P>Could you please help me with using REX/REGEX inside eval? Here is what I'm trying to do&nbsp;</P> <LI-CODE lang="markup">| makeresults | eval User="user1=test@domain.com | use1=test1" | makemv delim="|" User | mvexpand User | fields - _time | eval signature="87347,123,1,0,84" | makemv signature delim="," | mvexpand signature | eval account=if(like(signature,"87347") AND like(User,"%@%" )," REGEX USER TO KEEP EVERYTHING BEFORE @ "," DONT MAKE ANY CHANGES , KEEP THE USER WITH @")</LI-CODE> <P>Thanks&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> Fri, 08 Apr 2022 15:41:53 GMT https://community.splunk.com/t5/Splunk-Search/Could-you-please-help-me-with-using-REX-REGEX-inside-eval/m-p/593132#M206447 usscommunity 2022-04-08T15:41:53Z https://community.splunk.com/t5/Splunk-Search/Could-you-please-help-me-with-using-REX-REGEX-inside-eval/m-p/593147#M206451 <P>Given that the only time you change user is if signature is 87347 and in that instance you want everything before the&nbsp;@, just use split</P><LI-CODE lang="markup">| eval account=if(like(signature,"87347"),mvindex(split(user,"@"),0),user)</LI-CODE> Fri, 08 Apr 2022 17:36:54 GMT https://community.splunk.com/t5/Splunk-Search/Could-you-please-help-me-with-using-REX-REGEX-inside-eval/m-p/593147#M206451 ITWhisperer 2022-04-08T17:36:54Z https://community.splunk.com/t5/Splunk-Search/Could-you-please-help-me-with-using-REX-REGEX-inside-eval/m-p/593200#M206472 <P>An alternative is to use&nbsp;<A href="https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/TextFunctions#replace.28X.2CY.2CZ.29" target="_blank" rel="noopener">replace</A></P><LI-CODE lang="markup">| eval account=if(like(signature,"87347"),replace(user,"@.*",""),user)</LI-CODE><P data-unlink="true">Like ITWhisperer said, you do not need to test for %@%&nbsp;&nbsp;if your final operation is to get rid of&nbsp;@%. &nbsp;In the code you illustrated, the test for <FONT face="courier new,courier">signature</FONT> also do not include wildcard. &nbsp;Therefore,&nbsp;<FONT face="courier new,courier">like(signature, "87347")</FONT> is semantically identical to <FONT face="courier new,courier">signature=="87347"</FONT>, but slightly more expensive. &nbsp;Thanks for bring my attention to function "like()", BTW. &nbsp;I only used match() before.</P> Sat, 09 Apr 2022 22:39:43 GMT https://community.splunk.com/t5/Splunk-Search/Could-you-please-help-me-with-using-REX-REGEX-inside-eval/m-p/593200#M206472 yuanliu 2022-04-09T22:39:43Z