Splunk Search

Having Trouble With CASE

Motivator

Here is what I am using:

| eval siteName = case (Destination_IP == "199.47.*", dropbox.com)

I have tried everything and it is not working. Do you think it is because of the numbers "199.47.*"?

0 Karma
1 Solution

Contributor
| eval siteName = case(match(Destination_IP, "^199\.47\..*$"), "dropbox.com")

View solution in original post

Contributor
| eval siteName = case(match(Destination_IP,"^199\.47\..*”), "dropbox.com", match(Destination_IP,“^85\.17\.30\..*"), "megadownload.net", match(Destination_IP,"^195\.122\.131\..*"), "rapidshare.com")
0 Karma

Motivator

This is the real answer. thanks this fixed the issue. you are a regex guru. thanks again

0 Karma

Contributor
| eval siteName = case(match(Destination_IP, "^199\.47\..*$"), "dropbox.com")

View solution in original post

Contributor

I see now, / characters where removed

0 Karma

Motivator

OK I think I understand well not relay

So if I want to use case to get a variable named siteName and I have three possible sites identified by three possible IP’s I would normally use this

'| eval siteName = case (Destination_IP == "199.47.”, dropbox.com, Destination_IP == “85.17.30.", megadownload.net, Destination_IP == "195.122.131.*", rapidshare.com)'

But this isn’t working and the multiple matches are not working. Do you have any other suggestions for CASE

0 Karma

Contributor

the second argument of match function is a regex and "^199.47..$" in you example is not equal with "^199.47..*$" as I had suggested

http://www.addedbytes.com/cheat-sheets/regular-expressions-cheat-sheet/

0 Karma

Motivator

Opps the match doesn't seem to work in case
'| eval siteName = case(match(Destination_IP, "^199.47..$"), "dropbox.com",match(Destination_IP, "^85.17.30.$"), "megadownload.net",match(Destination_IP, "^195.122.131.*$"), "rapidshare.com")'

0 Karma

Motivator

HURA you are brilliant thanks

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!