cs_username field contains multiple formats of username in the form of:
Q #1 How to I remove domain\ or @domian.com elegantly
Q #2 How do I deduplicate those usernames that have different case sensitivies
I just want one list of usernames to pipe back into a subsearch
Driving me crazy.
Something like this?
main search foo [subsearch foo | eval username = lower(replace(username, "@.*", "")) | dedup username | fields username]
Removes everything after an @ symbol, converts to lower case, dedups, builds a huge OR'd expression to filter the main search.
View solution in original post
Does that mean your question is solved?
I wasn't using eval in conjunction with the replace command correctly 😞
This example with another pipe to eval to get rid of the domain\ seems to be doing the trick. Thank you SO much.