I have a field, let's say the user field, that has both usernames without a domain and some with.
I want the fields values that don't have an extension to have it added
Example:
sparky1
I want to be able to append splunk.com to the sparky1 value, without adding it again to sparky2@splunk.com
You can do something like this
Your base search with field say "username"
| eval username=if(match(username,"splunk.com$"),username,username."@splunk.com")
You can do something like this
Your base search with field say "username"
| eval username=if(match(username,"splunk.com$"),username,username."@splunk.com")
That worked! Thanks