I am trying this transform. Sometime the subjectuser is set and sometimes the targetuser. All works fine, but the data coming into the subject user is a dash, and that is what user is getting set to instead of the value that is correct in target user.
Is there any way around this? So, if a subject user is less than 2 characters for example?
Thanks!
You can use this:
EVAL-subjectuser=if(subjectuser=="-", targetuser, subjectuser)
Or in search SPL, this:
| eval subjectuser=if(subjectuser=="-", targetuser, subjectuser)
You can use this:
EVAL-subjectuser=if(subjectuser=="-", targetuser, subjectuser)
Or in search SPL, this:
| eval subjectuser=if(subjectuser=="-", targetuser, subjectuser)
you can add | replace "-" with "" in subjectuser
before coalesce