Hi
Could you please help me with using REX/REGEX inside eval? Here is what I'm trying to do
| makeresults
| eval User="user1=test@domain.com | use1=test1"
| makemv delim="|" User | mvexpand User
| fields - _time
| eval signature="87347,123,1,0,84"
| makemv signature delim=","
| mvexpand signature
| eval account=if(like(signature,"87347") AND like(User,"%@%" )," REGEX USER TO KEEP EVERYTHING BEFORE @ "," DONT MAKE ANY CHANGES , KEEP THE USER WITH @")
Thanks
Given that the only time you change user is if signature is 87347 and in that instance you want everything before the @, just use split
| eval account=if(like(signature,"87347"),mvindex(split(user,"@"),0),user)
An alternative is to use replace
| eval account=if(like(signature,"87347"),replace(user,"@.*",""),user)
Like ITWhisperer said, you do not need to test for %@% if your final operation is to get rid of @%. In the code you illustrated, the test for signature also do not include wildcard. Therefore, like(signature, "87347") is semantically identical to signature=="87347", but slightly more expensive. Thanks for bring my attention to function "like()", BTW. I only used match() before.