topic Re: Having Trouble With CASE in Splunk Search

Having Trouble With CASE

hartfoml — Wed, 11 Jan 2012 19:42:46 GMT

Here is what I am using:

| eval siteName = case (Destination_IP == "199.47.*", dropbox.com)

I have tried everything and it is not working. Do you think it is because of the numbers "199.47.*"?

Re: Having Trouble With CASE

imrago — Wed, 11 Jan 2012 20:47:53 GMT

| eval siteName = case(match(Destination_IP, "^199\.47\..*$"), "dropbox.com")

Re: Having Trouble With CASE

hartfoml — Wed, 11 Jan 2012 21:00:47 GMT

HURA you are brilliant thanks

Re: Having Trouble With CASE

hartfoml — Mon, 28 Sep 2020 10:18:13 GMT

Opps the match doesn't seem to work in case
'| eval siteName = case(match(Destination_IP, "^199.47..$"), "dropbox.com",match(Destination_IP, "^85.17.30.$"), "megadownload.net",match(Destination_IP, "^195.122.131.*$"), "rapidshare.com")'

Re: Having Trouble With CASE

imrago — Wed, 11 Jan 2012 21:58:41 GMT

the second argument of match function is a regex and "^199.47..$" in you example is not equal with "^199.47..*$" as I had suggested

http://www.addedbytes.com/cheat-sheets/regular-expressions-cheat-sheet/

Re: Having Trouble With CASE

hartfoml — Mon, 28 Sep 2020 10:18:16 GMT

OK I think I understand well not relay

So if I want to use case to get a variable named siteName and I have three possible sites identified by three possible IP’s I would normally use this

'| eval siteName = case (Destination_IP == "199.47.”, dropbox.com, Destination_IP == “85.17.30.", megadownload.net, Destination_IP == "195.122.131.*", rapidshare.com)'

But this isn’t working and the multiple matches are not working. Do you have any other suggestions for CASE

Re: Having Trouble With CASE

imrago — Wed, 11 Jan 2012 23:19:01 GMT

I see now, / characters where removed

Re: Having Trouble With CASE

imrago — Wed, 11 Jan 2012 23:21:54 GMT

| eval siteName = case(match(Destination_IP,"^199\.47\..*”), "dropbox.com", match(Destination_IP,“^85\.17\.30\..*"), "megadownload.net", match(Destination_IP,"^195\.122\.131\..*"), "rapidshare.com")

Re: Having Trouble With CASE

hartfoml — Thu, 12 Jan 2012 22:18:13 GMT

This is the real answer. thanks this fixed the issue. you are a regex guru. thanks again