Replace entire string if it contains partial string

[darls15]

Can anyone tell me how I would replace entire strings if they contain partial strings. As a basic example, in my search results, if a URL contains the word "homework", I would like to replace the entire URL with just "Homework", if it contains "learn", then "Learning" and so on. I have tried the search below a number of ways and can't seem to get it to work the way I need.

| eval domain = if(cs_host = "*homework*", "homework", if(cs_host = "*learn*", "learning",cs_host))

Domain            Count
Homework         2
Learning             5
etc

Thanks

[renjith_nair · Accepted solution]

@darls15,

Try

|eval category=case(like(domains, "%homework%"),"HomeWork",like(domains, "%learn%"),"Learning",like(domains, "%school%"),"School",1==1,domains)

Sample result

|makeresults|eval domains="https://homework.mydomain.com https://learn.mydomain.com https://school.mydomain.com"|makemv domains|mvexpand domains
|eval category=case(like(domains, "%homework%"),"HomeWork",like(domains, "%learn%"),"Learning",like(domains, "%school%"),"School",1==1,domains)
|stats count by category

alternatively you may use regex to extract the domains if there are multiple domains to be identified.

[darls15]

Thanks renjith_nair, just what I needed!