Nested case -> match within mvjoin

[Dworsnop]

Hello, I'm trying to create an multi-value field 'category' which takes its value from a 'case(match(' that queries a users AD group membership and returns the category value based on the memberOf field; see below.

... | eval category=mvjoin(case(match(memberOf, "(?i)^.*?CN\={employee AD group}\,?.+"),"employee",match(memberOf, "(?i)^.*?CN\={domain admins AD group}\,?.+"),"privileged",match(memberOf, "(?i)^.*?CN\={restricted internet AD group}\,?.+"),"rest_int"), "|")

For some reason though the final 'category' field only ever contains one value, despite some users being in more than one of the AD groups. mvappend doesn't work either.

[Dworsnop · Accepted solution]

Not to worry folks, I just did it this way...

| eval cat1=case(match(memberOf, "(?i)^.?CN={employee AD group}\,?.+"),"employee")
| eval cat2=case(match(memberOf, "(?i)^.?CN={domain admins AD group}\,?.+"),"privileged")
| eval cat3=case(match(memberOf, "(?i)^.*?CN={restricted internet AD group}\,?.+"),"rest_int")
| eval category=mvappend(cat1,cat2,cat3)

A bit more convoluted than I'd hoped but it works.

[woodcock]

You should at least UpVote @richgalloway because he lead you directly to the answer.

[richgalloway]

The case command only matches once so there will only be a single value to pass to mvjoin.

[Dworsnop]

Ah okay, thanks.

Any suggestions on how I can accomplish my goal?