Splunk Search

Adding email domain to values

Sparky1
Explorer

I have a field, let's say the user field, that has both usernames without a domain and some with.

I want the fields values that don't have an extension to have it added

 

Example:

sparky1

sparky2@splunk.com

 

I want to be able to append splunk.com to the sparky1 value, without adding it again to sparky2@splunk.com

Labels (1)
Tags (1)
0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

You can do something like this

Your base search with field say "username"
| eval username=if(match(username,"splunk.com$"),username,username."@splunk.com")

View solution in original post

0 Karma

somesoni2
SplunkTrust
SplunkTrust

You can do something like this

Your base search with field say "username"
| eval username=if(match(username,"splunk.com$"),username,username."@splunk.com")
0 Karma

Sparky1
Explorer

That worked! Thanks

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...