If statement wild card

[sumitkathpal292]

Hi All,

we need to define internal and external email segregation, we have the field sender and receiver fields . If sender equals *@hello.com and receiver equals *@hello.com than mark as internal all others external.

Currently i did if(sender=="*@hello.com" AND receiver=="*@hello.com.au","internal","external") but unsuccessful .

Any help?

[vnravikumar · Accepted solution]

HI @sumitkathpal2929

Try this,

| makeresults 
| eval sender ="test@hello.com",receiver="test1@hello.com" 
| eval result = if(match(sender,".*@hello\.com") AND match(receiver,".*@hello\.com"),"internal","external")

[sumitkathpal292]

Thanks, got it

[martin_mueller]

eval and where treat * as a literal character, not a wildcard. Use match().

[martin_mueller]

eval and where commands.

[woodcock]

... except in tsats.