Why am I receiving error on cidrmatch case statement?

[mistydennis]

I am having trouble getting this case statement to work (I receive "Error in eval command"):

  | eval match=case(cidrmatch("10.xx.x.0/16",asset_ip),"groupA", cidrmatch("10.xx.x.0/16",asset_ip),"groupA", cidrmatch("192.xx.xx.0/25",asset_ip),"groupA", cidrmatch("192.xxx.xx.0/24",asset_ip),"groupA", cidrmatch("10.xx.xx.0/24",asset_ip),"groupB", cidrmatch("192.xx.x.0/24",asset_ip),"groupB",  cidrmatch("192.xxx.xx.0/24",asset_ip),"groupB", cidrmatch("192.xxx.xx.0/24",asset_ip),"groupB",
 cidrmatch("10.xx.x.0/16",asset_ip),"groupC", cidrmatch("10.xx.x.0/16",asset_ip),"groupC", cidrmatch("10.xxx.x.0/16",asset_ip),"groupC", cidrmatch("10.xxx.x.0/16",asset_ip),"groupC", cidrmatch("10.xxx.x.0/16",asset_ip),"groupC", cidrmatch("10.xxx.x.0/16",asset_ip),"groupC", cidrmatch("10.xxx.x.0/16",asset_ip),"groupC"), "Other")

I can't seem to figure out why this isn't working. Is 'case' the wrong statement to use here?

[mistydennis]

Ah, thank you somesoni2. Can you point me in the direction of documentation regarding the default option condition? I'm not seeing much in the Splunk docs and I'd like to understand it more.

[somesoni2 · Accepted solution]

Your default option condition is missing. Try like this

| eval match=case(
cidrmatch("10.xx.x.0/16",asset_ip),"groupA", cidrmatch("10.xx.x.0/16",asset_ip),"groupA", cidrmatch("192.xx.xx.0/25",asset_ip),"groupA", cidrmatch("192.xxx.xx.0/24",asset_ip),"groupA", cidrmatch("10.xx.xx.0/24",asset_ip),"groupB", cidrmatch("192.xx.x.0/24",asset_ip),"groupB",  cidrmatch("192.xxx.xx.0/24",asset_ip),"groupB", cidrmatch("192.xxx.xx.0/24",asset_ip),"groupB",
 cidrmatch("10.xx.x.0/16",asset_ip),"groupC", cidrmatch("10.xx.x.0/16",asset_ip),"groupC", cidrmatch("10.xxx.x.0/16",asset_ip),"groupC", cidrmatch("10.xxx.x.0/16",asset_ip),"groupC", cidrmatch("10.xxx.x.0/16",asset_ip),"groupC", cidrmatch("10.xxx.x.0/16",asset_ip),"groupC", cidrmatch("10.xxx.x.0/16",asset_ip),"groupC",
true(), "Other")