I'm trying to create a calculated field (eval) that will coalesce a bunch of username fields, then perform match() and replace() functions within a case statement.
Here's a scenario:
- Possible user fields: UserName, username, User_ID
- User values need domain removed (e.g., "user@domain.com" or "ad\user" needs to be "user").
Here is how it can be done in two evals (I newlined and indented each case for readability):
| eval user_coalesced = coalesce(UserName, username, User_ID)
| eval user = case(
match(user_coalesced, ".*@.*"), replace(user_coalesced, "@.*", ""),
match(user_coalesced, "^ad\\\\"), replace(user_coalesced, "^ad\\\\", ""),
true(), user
)
Any ideas on how I can get this down to one? I thought about putting the coalesce() into each case, but that seems inefficient.
