Splunk Search

Adding Characters to the beginning of a field only when field starts with "\"

ajdyer2000
Path Finder

Hi

I have a search that returns a field called "Administrators"

Administrators

\DomainAdmins
\Backup Group
\Eventlog Administrators
user1
user2

for every entry that has a \ at the beginning I would like to put the word "Domain"

Domain\DomainAdmins
Domain\Backup Group
Domain\Eventlog Administrators
user1
user2

Tags (1)
0 Karma

ajdyer2000
Path Finder

Hi what would the new search look like?

0 Karma

somesoni2
Revered Legend

In @nickhillscpl's answer, replace first * with whatever search you've right now. Just add that | eval administrator... to end of your search.

0 Karma

nickhills
Ultra Champion

can you provide the search you are using now?

If my comment helps, please give it a thumbs up!
0 Karma

nickhills
Ultra Champion

This should work for you:

*|eval administrators=if(match(administrators, "^\\\.+"), "Domain".administrators, administrators)|table administrators
If my comment helps, please give it a thumbs up!

ajdyer2000
Path Finder

I get no results found with that

0 Karma

nickhills
Ultra Champion

whats your starting search?

If my comment helps, please give it a thumbs up!
0 Karma

DalJeanis
Legend

Probably want to put a carat ^ at the start of that, so it only matches at the beginning of the string.

"Match" returns true if the REGEX can find a match against any substring of SUBJECT.

0 Karma

nickhills
Ultra Champion

good point. edited.

If my comment helps, please give it a thumbs up!
0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...