Hi, I am pretty new to splunk and just doing some trial on my own.
This is the scenario. In the file I have a field "Country" which has multiple country names. I noticed that this field has multiple values which can be mapped to the same country. For eg. The field can be US, USA, US*, US/10 etc. all of which map to USA. I want to create a new field and write USA whenever these conditions occur.
I tried using CASE function as below, but it needs the specific word to search for. Is there a way to put a wildcard and search for everything which starts with 'US'.