Splunk Search

Why is the description field not functioning when using eval?

mtupper
New Member

Below is the search string I am using. Everything works like perfect except for the description field. The field remains blank when it should hold the description value. Is it because I am not using a CIDR match? I have tried a few variances of this with no luck. The csv file is populated from an hourly report. Any input is greatly appreciated.

Thanks

index=my_index sourcetype=my_sourcetype local_orig=F action=allowed
    [| inputcsv scanning_ip.csv]
| eval duration=round(duration,2)
| eval description=case(src="123.123.123.123/25", "This is our scanner, please ignore", src="123.123.123.123/16", "This is a government scanner, please ignore")
| table _time src src_port dest dest_port duration transport service conn_state_meaning description
| rename duration as "Duration_(seconds)"
| dedup src dest_port
| sort by src _time description
0 Karma

woodcock
Esteemed Legend

Try this instead:

... | eval description=case(cidrmatch("123.123.123.123/25", src), "This is our scanner, please ignore", cidrmatch("123.123.123.123/16", src), "This is a government scanner, please ignore")
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...