Thanks, it worked as expected. If we have 3 or multiple matches, do we required to write individual eval as mentioned below? for example, File Consumer XYZ_* Core ABC_* Core MNP_* ...
See more...
Thanks, it worked as expected. If we have 3 or multiple matches, do we required to write individual eval as mentioned below? for example, File Consumer XYZ_* Core ABC_* Core MNP_* Non-Core RST Non-Core SPL: base search
| rex field User | rex field Folder | rex field File
| eval Consumer = if(match(File, "^xyz"), "Core", "")
| eval Consumer = if(match(File,"^ABC"),"Core","")
| eval Consumer = if(match(File,"^MNP"),"Non-Core","")
| table File Consumer