Adding email domain to values

[Sparky1]

I have a field, let's say the user field, that has both usernames without a domain and some with.

I want the fields values that don't have an extension to have it added

Example:

sparky1

sparky2@splunk.com

I want to be able to append splunk.com to the sparky1 value, without adding it again to sparky2@splunk.com

[somesoni2 · Accepted solution]

You can do something like this

Your base search with field say "username"
| eval username=if(match(username,"splunk.com$"),username,username."@splunk.com")

[Sparky1]

That worked! Thanks