Adding Characters to the beginning of a field only when field starts with "\"

[ajdyer2000]

Hi

I have a search that returns a field called "Administrators"

Administrators

\DomainAdmins
\Backup Group
\Eventlog Administrators
user1
user2

for every entry that has a \ at the beginning I would like to put the word "Domain"

Domain\DomainAdmins
Domain\Backup Group
Domain\Eventlog Administrators
user1
user2

[ajdyer2000]

Hi what would the new search look like?

[somesoni2]

In @nickhillscpl's answer, replace first * with whatever search you've right now. Just add that | eval administrator... to end of your search.

[nickhills]

can you provide the search you are using now?

[nickhills]

This should work for you:

*|eval administrators=if(match(administrators, "^\\\.+"), "Domain".administrators, administrators)|table administrators

[ajdyer2000]

I get no results found with that

[nickhills]

whats your starting search?

[DalJeanis]

Probably want to put a carat ^ at the start of that, so it only matches at the beginning of the string.

"Match" returns true if the REGEX can find a match against any substring of SUBJECT.

[nickhills]

good point. edited.