Archive

rex n replace or rex and optional find

Communicator

cs_username field contains multiple formats of username in the form of:
username
domain\usernam
username@domain.com

Q #1 How to I remove domain\ or @domian.com elegantly

&

Q #2 How do I deduplicate those usernames that have different case sensitivies
username
USERNAME

I just want one list of usernames to pipe back into a subsearch

Driving me crazy.

Tags (1)
0 Karma
1 Solution

SplunkTrust
SplunkTrust

Something like this?

main search foo [subsearch foo | eval username = lower(replace(username, "@.*", "")) | dedup username | fields username]

Removes everything after an @ symbol, converts to lower case, dedups, builds a huge OR'd expression to filter the main search.

View solution in original post

SplunkTrust
SplunkTrust

Something like this?

main search foo [subsearch foo | eval username = lower(replace(username, "@.*", "")) | dedup username | fields username]

Removes everything after an @ symbol, converts to lower case, dedups, builds a huge OR'd expression to filter the main search.

View solution in original post

SplunkTrust
SplunkTrust

Does that mean your question is solved?

0 Karma

Communicator

I wasn't using eval in conjunction with the replace command correctly 😞

This example with another pipe to eval to get rid of the domain\ seems to be doing the trick. Thank you SO much.

0 Karma