Hi, I am pretty new to splunk and just doing some trial on my own.
This is the scenario. In the file I have a field "Country" which has multiple country names. I noticed that this field has multiple values which can be mapped to the same country. For eg. The field can be US, USA, US*, US/10 etc. all of which map to USA. I want to create a new field and write USA whenever these conditions occur.
I tried using CASE function as below, but it needs the specific word to search for. Is there a way to put a wildcard and search for everything which starts with 'US'.
case(country == "USA", "USA", url == "US", "USA", url == "US/10", "USA")
Is there any other function we can use in such scenario? Any suggestion will be helpful.
P.S. >> i am creating it in a Datamodel and will later use in pivot.
Thanks!
Try this. Let's create a new field called New_Country
eval New_Country = if(match(Country,"RUS"),"Russia",if(match(Country,"US"),"USA",Country))