https://community.splunk.com/t5/Splunk-Search/How-to-set-a-Variable-from-an-Eval-match/m-p/317144#M94878 <P>Try:</P> <PRE><CODE>| makeresults | eval clientip="10.1.3.4" | eval isImportant=if(((cidrmatch("10.1.1.0/24", clientip)) OR (cidrmatch("10.1.2.0/24", clientip))), "true", "false") </CODE></PRE> <P>Works with 10.1.1.4 and 10.1.2.4 properly, so you can try that.</P> Wed, 19 Jul 2017 16:21:57 GMT cpetterborg 2017-07-19T16:21:57Z https://community.splunk.com/t5/Splunk-Search/How-to-set-a-Variable-from-an-Eval-match/m-p/317143#M94877 <P>I am trying to set a new variable for each event, by using the eval command. Maybe I should a different command?</P> <P>I want to set a variable, isImportant, by IP address. I am trying to see if it falls into two or more ranges (10.1.1.* or 10.1.2.*). If the IP is in one of those ranges, I would like to have the variable isImportant set to true, otherwise set to false. </P> <P>I saw the following page:<BR /> <A href="http://docs.splunk.com/Documentation/SplunkCloud/6.6.0/SearchReference/Eval">http://docs.splunk.com/Documentation/SplunkCloud/6.6.0/SearchReference/Eval</A></P> <P>And it has an example for using one cidr range to set isLocal. I imagine I can use the example of:</P> <PRE><CODE>| eval isImportant=if(cidrmatch("10.1.1.0/24", clientip), "true", "false") </CODE></PRE> <P>for one range. When I try to use two ranges, it does not work. </P> <PRE><CODE>| eval isImportant=if((cidrmatch("10.1.1.0/24", clientip)) OR (cidrmatch("10.1.2.0/24", clientip))) </CODE></PRE> <P>The second example does not work.</P> <P>Is there a way to combine conditions into the eval?</P> Wed, 19 Jul 2017 16:02:56 GMT https://community.splunk.com/t5/Splunk-Search/How-to-set-a-Variable-from-an-Eval-match/m-p/317143#M94877 stakor 2017-07-19T16:02:56Z https://community.splunk.com/t5/Splunk-Search/How-to-set-a-Variable-from-an-Eval-match/m-p/317144#M94878 <P>Try:</P> <PRE><CODE>| makeresults | eval clientip="10.1.3.4" | eval isImportant=if(((cidrmatch("10.1.1.0/24", clientip)) OR (cidrmatch("10.1.2.0/24", clientip))), "true", "false") </CODE></PRE> <P>Works with 10.1.1.4 and 10.1.2.4 properly, so you can try that.</P> Wed, 19 Jul 2017 16:21:57 GMT https://community.splunk.com/t5/Splunk-Search/How-to-set-a-Variable-from-an-Eval-match/m-p/317144#M94878 cpetterborg 2017-07-19T16:21:57Z https://community.splunk.com/t5/Splunk-Search/How-to-set-a-Variable-from-an-Eval-match/m-p/317145#M94879 <P>Have you tried <CODE>| eval isImportant=if((cidrmatch("10.1.1.0/24", clientip)) OR (cidrmatch("10.1.2.0/24", clientip)), "true", "false")</CODE>?</P> Wed, 19 Jul 2017 16:24:01 GMT https://community.splunk.com/t5/Splunk-Search/How-to-set-a-Variable-from-an-Eval-match/m-p/317145#M94879 richgalloway 2017-07-19T16:24:01Z https://community.splunk.com/t5/Splunk-Search/How-to-set-a-Variable-from-an-Eval-match/m-p/317146#M94880 <P>You just specified the condition in if condition but no if-true and if-false actions.</P> Wed, 19 Jul 2017 16:27:22 GMT https://community.splunk.com/t5/Splunk-Search/How-to-set-a-Variable-from-an-Eval-match/m-p/317146#M94880 somesoni2 2017-07-19T16:27:22Z https://community.splunk.com/t5/Splunk-Search/How-to-set-a-Variable-from-an-Eval-match/m-p/317147#M94881 <P>This works. And I think would be my first choice of solution. Not sure if I can accept this as the solution or not though. </P> Wed, 19 Jul 2017 17:05:24 GMT https://community.splunk.com/t5/Splunk-Search/How-to-set-a-Variable-from-an-Eval-match/m-p/317147#M94881 stakor 2017-07-19T17:05:24Z https://community.splunk.com/t5/Splunk-Search/How-to-set-a-Variable-from-an-Eval-match/m-p/317148#M94882 <P>Now you should be.</P> Wed, 19 Jul 2017 18:07:26 GMT https://community.splunk.com/t5/Splunk-Search/How-to-set-a-Variable-from-an-Eval-match/m-p/317148#M94882 somesoni2 2017-07-19T18:07:26Z