Having Trouble With CASE

[hartfoml]

Here is what I am using:

| eval siteName = case (Destination_IP == "199.47.*", dropbox.com)

I have tried everything and it is not working. Do you think it is because of the numbers "199.47.*"?

[imrago]

| eval siteName = case(match(Destination_IP,"^199\.47\..*”), "dropbox.com", match(Destination_IP,“^85\.17\.30\..*"), "megadownload.net", match(Destination_IP,"^195\.122\.131\..*"), "rapidshare.com")

[hartfoml]

This is the real answer. thanks this fixed the issue. you are a regex guru. thanks again

[imrago · Accepted solution]

| eval siteName = case(match(Destination_IP, "^199\.47\..*$"), "dropbox.com")

[imrago]

I see now, / characters where removed

[hartfoml]

OK I think I understand well not relay

So if I want to use case to get a variable named siteName and I have three possible sites identified by three possible IP’s I would normally use this

'| eval siteName = case (Destination_IP == "199.47.”, dropbox.com, Destination_IP == “85.17.30.", megadownload.net, Destination_IP == "195.122.131.*", rapidshare.com)'

But this isn’t working and the multiple matches are not working. Do you have any other suggestions for CASE

[imrago]

the second argument of match function is a regex and "^199.47..$" in you example is not equal with "^199.47..*$" as I had suggested

http://www.addedbytes.com/cheat-sheets/regular-expressions-cheat-sheet/

[hartfoml]

Opps the match doesn't seem to work in case
'| eval siteName = case(match(Destination_IP, "^199.47..$"), "dropbox.com",match(Destination_IP, "^85.17.30.$"), "megadownload.net",match(Destination_IP, "^195.122.131.*$"), "rapidshare.com")'

[hartfoml]

HURA you are brilliant thanks