Archive

Adding Characters to the beginning of a field only when field starts with "\"

Engager

Hi

I have a search that returns a field called "Administrators"

Administrators

\DomainAdmins
\Backup Group
\Eventlog Administrators
user1
user2

for every entry that has a \ at the beginning I would like to put the word "Domain"

Domain\DomainAdmins
Domain\Backup Group
Domain\Eventlog Administrators
user1
user2

Tags (1)
0 Karma

Engager

Hi what would the new search look like?

0 Karma

Revered Legend

In @nickhillscpl's answer, replace first * with whatever search you've right now. Just add that | eval administrator... to end of your search.

0 Karma

Ultra Champion

can you provide the search you are using now?

0 Karma

Ultra Champion

This should work for you:

*|eval administrators=if(match(administrators, "^\\\.+"), "Domain".administrators, administrators)|table administrators

Engager

I get no results found with that

0 Karma

Ultra Champion

whats your starting search?

0 Karma

SplunkTrust
SplunkTrust

Probably want to put a carat ^ at the start of that, so it only matches at the beginning of the string.

"Match" returns true if the REGEX can find a match against any substring of SUBJECT.

0 Karma

Ultra Champion

good point. edited.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!