Archive

If statement wild card

New Member

Hi All,

we need to define internal and external email segregation, we have the field sender and receiver fields . If sender equals *@hello.com and receiver equals *@hello.com than mark as internal all others external.

Currently i did if(sender=="*@hello.com" AND receiver=="*@hello.com.au","internal","external") but unsuccessful .

Any help?

Tags (1)
0 Karma
1 Solution

Champion

HI @sumitkathpal2929

Try this,

| makeresults 
| eval sender ="test@hello.com",receiver="test1@hello.com" 
| eval result = if(match(sender,".*@hello\.com") AND match(receiver,".*@hello\.com"),"internal","external")

View solution in original post

Champion

HI @sumitkathpal2929

Try this,

| makeresults 
| eval sender ="test@hello.com",receiver="test1@hello.com" 
| eval result = if(match(sender,".*@hello\.com") AND match(receiver,".*@hello\.com"),"internal","external")

View solution in original post

New Member

Thanks, got it

0 Karma

SplunkTrust
SplunkTrust

eval and where treat * as a literal character, not a wildcard. Use match().

0 Karma

SplunkTrust
SplunkTrust

eval and where commands.

0 Karma

Esteemed Legend

... except in tsats.

0 Karma