How to write the syntax for eval to create a new field mapping variations of the same value?

[Roopaul]

Hi, I am pretty new to splunk and just doing some trial on my own.

This is the scenario. In the file I have a field "Country" which has multiple country names. I noticed that this field has multiple values which can be mapped to the same country. For eg. The field can be US, USA, US*, US/10 etc. all of which map to USA. I want to create a new field and write USA whenever these conditions occur.

I tried using CASE function as below, but it needs the specific word to search for. Is there a way to put a wildcard and search for everything which starts with 'US'.

case(country == "USA", "USA", url == "US", "USA", url == "US/10", "USA")

Is there any other function we can use in such scenario? Any suggestion will be helpful.

P.S. >> i am creating it in a Datamodel and will later use in pivot.

Thanks!

[Raghav2384]

Try this. Let's create a new field called New_Country

eval New_Country = if(match(Country,"RUS"),"Russia",if(match(Country,"US"),"USA",Country))