Hi
I have a search that returns a field called "Administrators"
Administrators
\DomainAdmins
\Backup Group
\Eventlog Administrators
user1
user2
for every entry that has a \ at the beginning I would like to put the word "Domain"
Domain\DomainAdmins
Domain\Backup Group
Domain\Eventlog Administrators
user1
user2
Hi what would the new search look like?
In @nickhillscpl's answer, replace first *
with whatever search you've right now. Just add that | eval administrator...
to end of your search.
can you provide the search you are using now?
This should work for you:
*|eval administrators=if(match(administrators, "^\\\.+"), "Domain".administrators, administrators)|table administrators
I get no results found with that
whats your starting search?
Probably want to put a carat ^ at the start of that, so it only matches at the beginning of the string.
"Match" returns true if the REGEX can find a match against any substring of SUBJECT.
good point. edited.