Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Eval not working

$
0
0
I am using regex to extract the subdomain from LDAP distiguishedName `- | ldapsearch search=”(&(objectClass=user)(!(objectClass=computer))(!(userAccountControl:1.2.840.113556.1.4.803:=2)))” attrs=”cn, distiguishedName, dNSHostName, operatingSystem, operatingSystemVersion”` I'm trying to use an eval to then give more value to the domain, ex: if domain is ABC, make a field "connection" and output sdwan. if domain is XYZ, output in connection column LAN. `mvexpand subdomain | eval connection=case(match(subdomain,"ABC"), "sdwan"` it will make sdwan in the connection column, but then also for domains like abcd, abdce etc.

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>