https://community.splunk.com/t5/Splunk-Search/limit-to-case-function/m-p/91133#M23448 <P>Hi this is a simple case query I ran on splunk</P> <P>... | eval country=case(country="US","USA",country="CA","CA","rest")</P> <P>For some reason splunk doesn't like it, is it because there is a limit to the case?</P> <P>thanks for the help</P> Thu, 05 Jul 2012 07:36:32 GMT Yarsa 2012-07-05T07:36:32Z https://community.splunk.com/t5/Splunk-Search/limit-to-case-function/m-p/91133#M23448 <P>Hi this is a simple case query I ran on splunk</P> <P>... | eval country=case(country="US","USA",country="CA","CA","rest")</P> <P>For some reason splunk doesn't like it, is it because there is a limit to the case?</P> <P>thanks for the help</P> Thu, 05 Jul 2012 07:36:32 GMT https://community.splunk.com/t5/Splunk-Search/limit-to-case-function/m-p/91133#M23448 Yarsa 2012-07-05T07:36:32Z https://community.splunk.com/t5/Splunk-Search/limit-to-case-function/m-p/91134#M23449 <P>You're not specifying a condition for your last term, "rest". <CODE>case</CODE> needs a boolean condition to be specified for each outcome it's supposed to act on. If you want a "default" kind of condition, you could specify something that you know always to be true (<CODE>1=1</CODE> for instance) as the last term because <CODE>case</CODE> will evaluate the statements sequentially.</P> <PRE><CODE>... | eval country=case(country="US","USA",country="CA","CA",1=1,"rest") </CODE></PRE> Thu, 05 Jul 2012 08:09:42 GMT https://community.splunk.com/t5/Splunk-Search/limit-to-case-function/m-p/91134#M23449 Ayn 2012-07-05T08:09:42Z