Splunk Search

rex n replace or rex and optional find

TobiasBoone
Communicator

cs_username field contains multiple formats of username in the form of:
username
domain\usernam
username@domain.com

Q #1 How to I remove domain\ or @domian.com elegantly

&

Q #2 How do I deduplicate those usernames that have different case sensitivies
username
USERNAME

I just want one list of usernames to pipe back into a subsearch

Driving me crazy.

Tags (1)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Something like this?

main search foo [subsearch foo | eval username = lower(replace(username, "@.*", "")) | dedup username | fields username]

Removes everything after an @ symbol, converts to lower case, dedups, builds a huge OR'd expression to filter the main search.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

Something like this?

main search foo [subsearch foo | eval username = lower(replace(username, "@.*", "")) | dedup username | fields username]

Removes everything after an @ symbol, converts to lower case, dedups, builds a huge OR'd expression to filter the main search.

martin_mueller
SplunkTrust
SplunkTrust

Does that mean your question is solved?

0 Karma

TobiasBoone
Communicator

I wasn't using eval in conjunction with the replace command correctly 😞

This example with another pipe to eval to get rid of the domain\ seems to be doing the trick. Thank you SO much.

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...