If results in column contain value, show custom value in another column

[lestertang]

Hi all,

Say for example if i have a column which contains ip addresses. I want to set it in a way, if the ip contains x.x.x.x then in another column next to it, it will display non-production in that row. If y.y.y.y then display production. Is it even possible?

[martin_mueller]

Yes, there are many ways - eval + if, eval + case, lookups, maybe more.

[martin_mueller]

You could chain multiple boolean expressions with OR.

If your list becomes longer you may want to take a look at http://splunk-base.splunk.com/answers/5916/using-cidr-in-a-lookup-table

[lestertang]

Thanks, i've manage to do this but any idea how do i add on multiple addresses? say i have y.y.y.y/16 and z.z.z.z/24

"| eval network=if(cidrmatch("x.x.x.x/16", Dest_IP), "Production", "Non Production")"