Splunk Search

Adding Characters to the beginning of a field only when field starts with "\"

ajdyer2000
Path Finder

Hi

I have a search that returns a field called "Administrators"

Administrators

\DomainAdmins
\Backup Group
\Eventlog Administrators
user1
user2

for every entry that has a \ at the beginning I would like to put the word "Domain"

Domain\DomainAdmins
Domain\Backup Group
Domain\Eventlog Administrators
user1
user2

Tags (1)
0 Karma

ajdyer2000
Path Finder

Hi what would the new search look like?

0 Karma

somesoni2
Revered Legend

In @nickhillscpl's answer, replace first * with whatever search you've right now. Just add that | eval administrator... to end of your search.

0 Karma

nickhills
Ultra Champion

can you provide the search you are using now?

If my comment helps, please give it a thumbs up!
0 Karma

nickhills
Ultra Champion

This should work for you:

*|eval administrators=if(match(administrators, "^\\\.+"), "Domain".administrators, administrators)|table administrators
If my comment helps, please give it a thumbs up!

ajdyer2000
Path Finder

I get no results found with that

0 Karma

nickhills
Ultra Champion

whats your starting search?

If my comment helps, please give it a thumbs up!
0 Karma

DalJeanis
Legend

Probably want to put a carat ^ at the start of that, so it only matches at the beginning of the string.

"Match" returns true if the REGEX can find a match against any substring of SUBJECT.

0 Karma

nickhills
Ultra Champion

good point. edited.

If my comment helps, please give it a thumbs up!
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...