Splunk Search

How to use eval and asterisk?

Builder

Hi

How to use asterisk in the eval case search? I have to assign a value to the IP ranges.

for Ip range 1.2.* - Low
for Ip range 3.4.* - Medium
for IP range 5.* - High

I tried below search, its not working
search | eval case(src_ip=1.2.* , "Low", src_ip=3.4.* ,"Medium", src_ip=5.*. "High")

Tags (2)
0 Karma
1 Solution

Esteemed Legend

Like this:

search | eval case(like(src_ip, "1.2.%"), "Low", like(src_ip, "3.4.%") ,"Medium", like(src_ip, "5._%.%"), "High")

View solution in original post

Esteemed Legend

Like this:

search | eval case(like(src_ip, "1.2.%"), "Low", like(src_ip, "3.4.%") ,"Medium", like(src_ip, "5._%.%"), "High")

View solution in original post

Builder

Thank you!

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!