Archive

If statement wild card

New Member

Hi All,

we need to define internal and external email segregation, we have the field sender and receiver fields . If sender equals *@hello.com and receiver equals *@hello.com than mark as internal all others external.

Currently i did if(sender=="*@hello.com" AND receiver=="*@hello.com.au","internal","external") but unsuccessful .

Any help?

Tags (1)
0 Karma
1 Solution

Champion

HI @sumitkathpal2929

Try this,

| makeresults 
| eval sender ="test@hello.com",receiver="test1@hello.com" 
| eval result = if(match(sender,".*@hello\.com") AND match(receiver,".*@hello\.com"),"internal","external")

View solution in original post

Champion

HI @sumitkathpal2929

Try this,

| makeresults 
| eval sender ="test@hello.com",receiver="test1@hello.com" 
| eval result = if(match(sender,".*@hello\.com") AND match(receiver,".*@hello\.com"),"internal","external")

View solution in original post

New Member

Thanks, got it

0 Karma

SplunkTrust
SplunkTrust

eval and where treat * as a literal character, not a wildcard. Use match().

0 Karma

SplunkTrust
SplunkTrust

eval and where commands.

0 Karma

Esteemed Legend

... except in tsats.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!