- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
verifi81
Path Finder
04-28-2021
10:44 PM
Hi folks
I'm providing a sample of many values I have for field: username
Field: username
Value:
Roger Smith
Bob Dole
Randy Savage
I'm trying to create another field with the EVAL command called EMAIL and placing a dot between first name and last name followed by @Anonymous.com
Basically I'm trying to get the new field like this.
Field: Email
Roger.Smith@falcon.com
Bob.Dole@falcon.com
Randy.Savage@falcon.com
What would the syntax be?
Thanks in advance
1 Solution
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

kamlesh_vaghela

SplunkTrust
04-28-2021
10:52 PM
You should try something like this.
YOUR_SEARCH | eval email= replace(username," ",".")."@falcon.com" | table username email
Sample search.
| makeresults | eval _raw="
username
Roger Smith
Bob Dole
Randy Savage
" | multikv forceheader=1 | eval email= replace(username," ",".")."@falcon.com" | table username email
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
verifi81
Path Finder
04-29-2021
10:04 AM
I stand corrected. It worked. Thank you!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
verifi81
Path Finder
04-29-2021
10:02 AM
Hello Kamlesh,
My list of username is 1000 entries long so I won't be able to specify it like that.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

kamlesh_vaghela

SplunkTrust
04-28-2021
10:52 PM
You should try something like this.
YOUR_SEARCH | eval email= replace(username," ",".")."@falcon.com" | table username email
Sample search.
| makeresults | eval _raw="
username
Roger Smith
Bob Dole
Randy Savage
" | multikv forceheader=1 | eval email= replace(username," ",".")."@falcon.com" | table username email
