Archive
Highlighted

Adding Characters to the beginning of a field only when field starts with "\"

Engager

Hi

I have a search that returns a field called "Administrators"

Administrators

\DomainAdmins
\Backup Group
\Eventlog Administrators
user1
user2

for every entry that has a \ at the beginning I would like to put the word "Domain"

Domain\DomainAdmins
Domain\Backup Group
Domain\Eventlog Administrators
user1
user2

Tags (1)
0 Karma
Highlighted

Re: Adding Characters to the beginning of a field only when field starts with "\"

Ultra Champion

This should work for you:

*|eval administrators=if(match(administrators, "^\\\.+"), "Domain".administrators, administrators)|table administrators
Highlighted

Re: Adding Characters to the beginning of a field only when field starts with "\"

SplunkTrust
SplunkTrust

Probably want to put a carat ^ at the start of that, so it only matches at the beginning of the string.

"Match" returns true if the REGEX can find a match against any substring of SUBJECT.

0 Karma
Highlighted

Re: Adding Characters to the beginning of a field only when field starts with "\"

Ultra Champion

good point. edited.

0 Karma
Highlighted

Re: Adding Characters to the beginning of a field only when field starts with "\"

Engager

I get no results found with that

0 Karma
Highlighted

Re: Adding Characters to the beginning of a field only when field starts with "\"

Ultra Champion

whats your starting search?

0 Karma
Highlighted

Re: Adding Characters to the beginning of a field only when field starts with "\"

Engager

Hi what would the new search look like?

0 Karma
Highlighted

Re: Adding Characters to the beginning of a field only when field starts with "\"

Ultra Champion

can you provide the search you are using now?

0 Karma
Highlighted

Re: Adding Characters to the beginning of a field only when field starts with "\"

SplunkTrust
SplunkTrust

In @nickhillscpl's answer, replace first * with whatever search you've right now. Just add that | eval administrator... to end of your search.

0 Karma