Reporting

If statement wild card

sumitkathpal292
New Member

Hi All,

we need to define internal and external email segregation, we have the field sender and receiver fields . If sender equals *@hello.com and receiver equals *@hello.com than mark as internal all others external.

Currently i did if(sender=="*@hello.com" AND receiver=="*@hello.com.au","internal","external") but unsuccessful .

Any help?

Tags (1)
0 Karma
1 Solution

vnravikumar
Champion

HI @sumitkathpal2929

Try this,

| makeresults 
| eval sender ="test@hello.com",receiver="test1@hello.com" 
| eval result = if(match(sender,".*@hello\.com") AND match(receiver,".*@hello\.com"),"internal","external")

View solution in original post

vnravikumar
Champion

HI @sumitkathpal2929

Try this,

| makeresults 
| eval sender ="test@hello.com",receiver="test1@hello.com" 
| eval result = if(match(sender,".*@hello\.com") AND match(receiver,".*@hello\.com"),"internal","external")

sumitkathpal292
New Member

Thanks, got it

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

eval and where treat * as a literal character, not a wildcard. Use match().

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

eval and where commands.

0 Karma

woodcock
Esteemed Legend

... except in tsats.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...