Splunk Search

How too Add exception in "case"?



I have several model id: 12310, 12320, 12330. If the suffixes = "10", "20", "30", I define the typemachine accordingly.

type typemachine
10 car
20 moto
30 bicycle


| eval typemachine=case(type="10", "car", type="20", "moto ", type="30", "bicycle", 1=1, "autre")

However I want to add the exception, if id=56410 or 65210, it must be the "moto".

Can I do it, please? 


Labels (2)
Tags (1)
0 Karma

Esteemed Legend

Hi @Julia1231,

the easiest approach is adding the additional conditions to your case, something like this:

| eval typemachine=case(type="10", "car", type="20", "moto", type="30", "bicycle", id=56410 OR id=65210, "moto", 1=1, "autre")



0 Karma

Revered Legend

I believe you want to override suffix based match, so I would put 'id' filter first so that they are checked first. Like this:

| eval typemachine=case(id="56410" OR id="65210", "moto", type="10", "car", type="20", "moto", type="30", "bicycle", true(), "autre")
0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...

Security Newsletter Updates | March 2023

 March 2023 | Check out the latest and greatestUnify Your Security Operations with Splunk Mission Control The ...