Create a new field based on existing filelds

[sidtalup27]

Hello,

My requirement is if the field "fields.summary" contains events that contain ".DT", then I want to create a new field "Summary", and set the value of the new field as Security Incident. I have created the below query, but its not working as expected. 

index="main" AND source=jira | spath
| eval summary=if(match (fields.summary,".DT-"),"Security Incident","no")

Please advise.

--
Thanks,
Siddarth

[ITWhisperer · Accepted solution]

The match function uses a regular expression syntax to match the value in the field - "." is a wildcard character in regular expressions so these (along with other special characters) need to be escaped.  Field names with special characters should also be quoted with single quotes. Try this

index="main" AND source=jira | spath
| eval summary=if(match ('fields.summary',"\.DT\-"),"Security Incident","no")