Splunk Search
Highlighted

If results in column contain value, show custom value in another column

New Member

Hi all,

Say for example if i have a column which contains ip addresses. I want to set it in a way, if the ip contains x.x.x.x then in another column next to it, it will display non-production in that row. If y.y.y.y then display production. Is it even possible?

Tags (2)
0 Karma
Highlighted

Re: If results in column contain value, show custom value in another column

SplunkTrust
SplunkTrust

Yes, there are many ways - eval + if, eval + case, lookups, maybe more.

0 Karma
Highlighted

Re: If results in column contain value, show custom value in another column

New Member

Thanks, i've manage to do this but any idea how do i add on multiple addresses? say i have y.y.y.y/16 and z.z.z.z/24

"| eval network=if(cidrmatch("x.x.x.x/16", Dest_IP), "Production", "Non Production")"

0 Karma
Highlighted

Re: If results in column contain value, show custom value in another column

SplunkTrust
SplunkTrust

You could chain multiple boolean expressions with OR.

If your list becomes longer you may want to take a look at http://splunk-base.splunk.com/answers/5916/using-cidr-in-a-lookup-table

0 Karma