Eval for known and unknown field values

[ashabc]

I am using a search command to rename ip address output to device names something like below:

sourcetype=syslog | eval srcip = case(srcip = "192.168.x.5","Samsung S4", srcip = "192.168.x.8","iPhone5", srcip = "192.168.x.10","Laptop") | rename "srcip" as "Device Name"  | stats count by "Device Name" 

The problem is with the above command is, it only displays the devices that are in the case statement. How can I display all the devices in the sourcetype/log both defined in the case statement and those are not defined (the IP address instead of name is fine for the devices which are not defined in the case statement). For example there could be a device in the logfile with srcip=192.168.x.21 which is not defned in the case statement, and hence will not show in the output, but I would lke this device be displayed as 192.168.x.21 in the stats command output.

[martin_mueller · Accepted solution]

Make your case() keep the original value for unknown values like this:

... | eval srcip = case(srcip = "192.168.x.5","Samsung S4", srcip = "192.168.x.8","iPhone5", srcip = "192.168.x.10","Laptop", 1=1, srcip)

As an entirely different alternative, define a lookup table containing your known mapped values. That'll keep this knowledge out of potentially many searches.

[ashabc]

Thank you Martin for responding to my post. When I use the command you suggested, it throws an error "Unknown search command 'case'. "
Any syntax issue in 1=1, srcip ?

[ashabc]

Sorry my bad. Its was indded a syntax from my end. Thank you so much for your help, Martin.

[_d_]

You need to do the eval and rename after your stats:

sourcetype=syslog | stats count by srcip | eval srcip = case(srcip = "192.168.x.5","Samsung S4", srcip = "192.168.x.8","iPhone5", srcip = "192.168.x.10","Laptop", true(), srcip) | rename "srcip" as "Device Name"