How to replace empty field with specific string ?

[mah]

hi, 

I have a search like this : 

|rest /services/data/indexes splunk_server=local count=0 | search disabled=0 title!=_blocksignature title!=_thefishbucket | rename title AS index | fields index
| lookup indexes.csv index OUTPUT account
| search index=*xxx*

The result is a table like that :

index	account
xxx-aaa
xxx-bbb	D
ccc-xxx

I want to fill empty cell account with "D" account only for index containing "xxx" string.

I tried an eval :  | eval account=if(index=="*xxx*","D",account)  but it doesn't work. 

Can you help me ?

Thanks.

[493669 · Accepted solution]

@mah Try below-

| eval account=if(match(index,"xxx"),"D",account)