Thanks is there any way to split it, I tried this but it is not working index=collect_identities sourcetype=ldap:query
| dedup email
| eval identity=replace(identity, "Adm0", "")
| eval identity=re...
See more...
Thanks is there any way to split it, I tried this but it is not working index=collect_identities sourcetype=ldap:query
| dedup email
| eval identity=replace(identity, "Adm0", "")
| eval identity=replace(identity, "Adm", "")
| eval identity=lower(identity)
| stats
values(email) AS email
values(extensionAttribute10) AS extensionAttribute10
values(extensionAttribute11) AS extensionAttribute11
values(first) AS first
values(last) AS last
BY identity
| eval email=split(email, "")
| eval extensionAttribute10=split(extensionAttribute10, "")
| eval extensionAttribute11=split(extensionAttribute11, "")
| eval first=split(first, "")
| eval last=split(last, "")
| mvexpand email
| mvexpand extensionAttribute10
| mvexpand extensionAttribute11
| mvexpand first
| mvexpand last