rex n replace or rex and optional find

[TobiasBoone]

cs_username field contains multiple formats of username in the form of:
username
domain\usernam
username@domain.com

Q #1 How to I remove domain\ or @domian.com elegantly

&

Q #2 How do I deduplicate those usernames that have different case sensitivies
username
USERNAME

I just want one list of usernames to pipe back into a subsearch

Driving me crazy.

[martin_mueller · Accepted solution]

Something like this?

main search foo [subsearch foo | eval username = lower(replace(username, "@.*", "")) | dedup username | fields username]

Removes everything after an @ symbol, converts to lower case, dedups, builds a huge OR'd expression to filter the main search.

[martin_mueller]

Does that mean your question is solved?

[TobiasBoone]

I wasn't using eval in conjunction with the replace command correctly 😞

This example with another pipe to eval to get rid of the domain\ seems to be doing the trick. Thank you SO much.