Reporting

If statement wild card

sumitkathpal292
New Member

Hi All,

we need to define internal and external email segregation, we have the field sender and receiver fields . If sender equals *@hello.com and receiver equals *@hello.com than mark as internal all others external.

Currently i did if(sender=="*@hello.com" AND receiver=="*@hello.com.au","internal","external") but unsuccessful .

Any help?

Tags (1)
0 Karma
1 Solution

vnravikumar
Champion

HI @sumitkathpal2929

Try this,

| makeresults 
| eval sender ="test@hello.com",receiver="test1@hello.com" 
| eval result = if(match(sender,".*@hello\.com") AND match(receiver,".*@hello\.com"),"internal","external")

View solution in original post

vnravikumar
Champion

HI @sumitkathpal2929

Try this,

| makeresults 
| eval sender ="test@hello.com",receiver="test1@hello.com" 
| eval result = if(match(sender,".*@hello\.com") AND match(receiver,".*@hello\.com"),"internal","external")

sumitkathpal292
New Member

Thanks, got it

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

eval and where treat * as a literal character, not a wildcard. Use match().

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

eval and where commands.

0 Karma

woodcock
Esteemed Legend

... except in tsats.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...