Splunk Search

Why is the description field not functioning when using eval?

mtupper
New Member

Below is the search string I am using. Everything works like perfect except for the description field. The field remains blank when it should hold the description value. Is it because I am not using a CIDR match? I have tried a few variances of this with no luck. The csv file is populated from an hourly report. Any input is greatly appreciated.

Thanks

index=my_index sourcetype=my_sourcetype local_orig=F action=allowed
    [| inputcsv scanning_ip.csv]
| eval duration=round(duration,2)
| eval description=case(src="123.123.123.123/25", "This is our scanner, please ignore", src="123.123.123.123/16", "This is a government scanner, please ignore")
| table _time src src_port dest dest_port duration transport service conn_state_meaning description
| rename duration as "Duration_(seconds)"
| dedup src dest_port
| sort by src _time description
0 Karma

woodcock
Esteemed Legend

Try this instead:

... | eval description=case(cidrmatch("123.123.123.123/25", src), "This is our scanner, please ignore", cidrmatch("123.123.123.123/16", src), "This is a government scanner, please ignore")
0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...