you could always convert one to the other format then directly compare them using regular expressions
or break up the address into fields (firstname, lastname, domain, etc) and compare each piece directly.
Personally, I'd convert the events with the first format to match the second format and then compare them. It would be something like this run anywhere command:
| makeresults| eval first="email@example.com", second="first_last_test_com" | eval compare_first=first | rex mode=sed field=compare_first "s/[\.@]/_/g" | where compare_first=second
And if you didn't need to preserve the first one, you could make it even easier:
| makeresults| eval first="firstname.lastname@example.org", second="first_last_test_com" | rex mode=sed field=first "s/[\.@]/_/g" | where first=second
Thank you @elliotproebstel for your suggestions. Will try to use that!
I've converted the regular formatted email "email@example.com" to the second format by
replacing "." and "@" with "_":
Field "userid" had value firstname.lastname@example.org.
...|eval useridformated = replace(userid,"\.","_") | eval useridformated = replace(useridformated,"@","_") ...