How to set a Variable from an Eval match?

[stakor]

I am trying to set a new variable for each event, by using the eval command. Maybe I should a different command?

I want to set a variable, isImportant, by IP address. I am trying to see if it falls into two or more ranges (10.1.1.* or 10.1.2.*). If the IP is in one of those ranges, I would like to have the variable isImportant set to true, otherwise set to false.

I saw the following page:
http://docs.splunk.com/Documentation/SplunkCloud/6.6.0/SearchReference/Eval

And it has an example for using one cidr range to set isLocal. I imagine I can use the example of:

| eval isImportant=if(cidrmatch("10.1.1.0/24", clientip), "true", "false")

for one range. When I try to use two ranges, it does not work.

| eval isImportant=if((cidrmatch("10.1.1.0/24", clientip)) OR (cidrmatch("10.1.2.0/24", clientip)))

The second example does not work.

Is there a way to combine conditions into the eval?

[somesoni2]

You just specified the condition in if condition but no if-true and if-false actions.

[richgalloway]

Have you tried | eval isImportant=if((cidrmatch("10.1.1.0/24", clientip)) OR (cidrmatch("10.1.2.0/24", clientip)), "true", "false")?

[stakor]

This works. And I think would be my first choice of solution. Not sure if I can accept this as the solution or not though.

[somesoni2]

Now you should be.

[cpetterborg]

Try:

| makeresults | eval clientip="10.1.3.4" | eval isImportant=if(((cidrmatch("10.1.1.0/24", clientip)) OR (cidrmatch("10.1.2.0/24", clientip))), "true", "false")

Works with 10.1.1.4 and 10.1.2.4 properly, so you can try that.