username to split - domain\user
expected result for user2 field - domain
user
SPL - | eval user2=split(user,"\")
error stated - unbalanced quotes
thanks for assistance
The backslash character is the escape character. To use a literal backslash you must escape it.
| eval user2=split(user,"\\")
The backslash character is the escape character. To use a literal backslash you must escape it.
| eval user2=split(user,"\\")
@richgalloway thanks - the spl works