Splunk Search

How would I use eval with a wildcard to create a combined value?

the_wolverine
Champion

I have many email addresses that I want to lump by domain. How do I use eval to do this?

1 Solution

the_wolverine
Champion

index=main sourcetype=email address=* | eval domain=case(address LIKE "%gmail.com", "GMAIL", address LIKE "%yahoo.com", "YAHOO",address LIKE "%hotmail.com","HOTMAIL") | stats count by domain

(% is the wildcard)

There are many ways to do this so I hope other folks add their examples.

View solution in original post

mikaelbje
Motivator

For completeness here's another way to achieve this:

index=* address=* | eval x=split(address, "@") | eval domain=mvindex(x,1)

Not sure which solution is faster though

sk314
Builder

You could also use rex on your email address field to capture domain in a separate field. This way you do not have to list out all possible domain cases in an eval statement.

For example:

index=<your index> sourcetype=<your sourcetype> | rex field=<email_address_field> "\w+@(?<domain>\w+)\.\w+" | ... 

This captures your domains in a separate field (domain). Hope this helps.

the_wolverine
Champion

index=main sourcetype=email address=* | eval domain=case(address LIKE "%gmail.com", "GMAIL", address LIKE "%yahoo.com", "YAHOO",address LIKE "%hotmail.com","HOTMAIL") | stats count by domain

(% is the wildcard)

There are many ways to do this so I hope other folks add their examples.

Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

&#x1f342; Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...