Splunk Enterprise Security: How to do conditional regex?

[mikeyph]

I'm trying to unify records from two different indexes, as part of this I'm trying to create a common field by extracting user ID's from existing fields (these are full of other data I don't want and which isn't unified). It's working in so far as my regex matches as expected, however there are variants in userID types, such as emails with first and surname, emails with a single name, a one-word user ID etc.
I can regex for these easily enough but it will overwrite the previous field contents for my working regex, and I want all input into 1 field.

How do I do conditional regex?
i.e. where first regex fails to match on record, try next regex.

Below is an example I have that is correctly returning the fullname email into the new field.
This obviously doesn't match on any of the other examples I gave- meaning I have multiple blank cells.

|rex field=first_index_field \{\"id\"\:\"(?<Common_Field>\w+\.\w+\@\w+\.\w+)
|rex field=second_index_field .*sername\=(?<Common_Field>\w+\.\w+\@\w+\.\w+)

[gcusello]

HI @mikeyph,
you could extract all the fullnames using different regex for each sourcetype as you did but with different field names (e.g. Common_Field1, Common_Field2) and then unify them using coalesce:

my_search
|rex field=first_index_field \{\"id\"\:\"(?<Common_Field1>\w+\.\w+\@\w+\.\w+)
|rex field=second_index_field .*sername\=(?<Common_Field2>\w+\.\w+\@\w+\.\w+)
| eval Common_Field=coalesce(Common_Field1,Common_Field2)
| ...

Ciao.
Giuseppe