Splunk Search

Why am I receiving error on cidrmatch case statement?

mistydennis
Communicator

I am having trouble getting this case statement to work (I receive "Error in eval command"):

 

  | eval match=case(cidrmatch("10.xx.x.0/16",asset_ip),"groupA", cidrmatch("10.xx.x.0/16",asset_ip),"groupA", cidrmatch("192.xx.xx.0/25",asset_ip),"groupA", cidrmatch("192.xxx.xx.0/24",asset_ip),"groupA", cidrmatch("10.xx.xx.0/24",asset_ip),"groupB", cidrmatch("192.xx.x.0/24",asset_ip),"groupB",  cidrmatch("192.xxx.xx.0/24",asset_ip),"groupB", cidrmatch("192.xxx.xx.0/24",asset_ip),"groupB",
 cidrmatch("10.xx.x.0/16",asset_ip),"groupC", cidrmatch("10.xx.x.0/16",asset_ip),"groupC", cidrmatch("10.xxx.x.0/16",asset_ip),"groupC", cidrmatch("10.xxx.x.0/16",asset_ip),"groupC", cidrmatch("10.xxx.x.0/16",asset_ip),"groupC", cidrmatch("10.xxx.x.0/16",asset_ip),"groupC", cidrmatch("10.xxx.x.0/16",asset_ip),"groupC"), "Other")

 

 

 

 

I can't seem to figure out why this isn't working. Is 'case' the wrong statement to use here?

 

Labels (1)
Tags (2)
0 Karma
1 Solution

somesoni2
Revered Legend

Your default option condition is missing. Try like this

| eval match=case(
cidrmatch("10.xx.x.0/16",asset_ip),"groupA", cidrmatch("10.xx.x.0/16",asset_ip),"groupA", cidrmatch("192.xx.xx.0/25",asset_ip),"groupA", cidrmatch("192.xxx.xx.0/24",asset_ip),"groupA", cidrmatch("10.xx.xx.0/24",asset_ip),"groupB", cidrmatch("192.xx.x.0/24",asset_ip),"groupB",  cidrmatch("192.xxx.xx.0/24",asset_ip),"groupB", cidrmatch("192.xxx.xx.0/24",asset_ip),"groupB",
 cidrmatch("10.xx.x.0/16",asset_ip),"groupC", cidrmatch("10.xx.x.0/16",asset_ip),"groupC", cidrmatch("10.xxx.x.0/16",asset_ip),"groupC", cidrmatch("10.xxx.x.0/16",asset_ip),"groupC", cidrmatch("10.xxx.x.0/16",asset_ip),"groupC", cidrmatch("10.xxx.x.0/16",asset_ip),"groupC", cidrmatch("10.xxx.x.0/16",asset_ip),"groupC",
true(), "Other")

View solution in original post

0 Karma

mistydennis
Communicator

Ah, thank you somesoni2. Can you point me in the direction of documentation regarding the default option condition? I'm not seeing much in the Splunk docs and I'd like to understand it more.

0 Karma

somesoni2
Revered Legend

Your default option condition is missing. Try like this

| eval match=case(
cidrmatch("10.xx.x.0/16",asset_ip),"groupA", cidrmatch("10.xx.x.0/16",asset_ip),"groupA", cidrmatch("192.xx.xx.0/25",asset_ip),"groupA", cidrmatch("192.xxx.xx.0/24",asset_ip),"groupA", cidrmatch("10.xx.xx.0/24",asset_ip),"groupB", cidrmatch("192.xx.x.0/24",asset_ip),"groupB",  cidrmatch("192.xxx.xx.0/24",asset_ip),"groupB", cidrmatch("192.xxx.xx.0/24",asset_ip),"groupB",
 cidrmatch("10.xx.x.0/16",asset_ip),"groupC", cidrmatch("10.xx.x.0/16",asset_ip),"groupC", cidrmatch("10.xxx.x.0/16",asset_ip),"groupC", cidrmatch("10.xxx.x.0/16",asset_ip),"groupC", cidrmatch("10.xxx.x.0/16",asset_ip),"groupC", cidrmatch("10.xxx.x.0/16",asset_ip),"groupC", cidrmatch("10.xxx.x.0/16",asset_ip),"groupC",
true(), "Other")
0 Karma