limit to case function?

[Yarsa]

Hi this is a simple case query I ran on splunk

... | eval country=case(country="US","USA",country="CA","CA","rest")

For some reason splunk doesn't like it, is it because there is a limit to the case?

thanks for the help

[Ayn · Accepted solution]

You're not specifying a condition for your last term, "rest". case needs a boolean condition to be specified for each outcome it's supposed to act on. If you want a "default" kind of condition, you could specify something that you know always to be true (1=1 for instance) as the last term because case will evaluate the statements sequentially.

... | eval country=case(country="US","USA",country="CA","CA",1=1,"rest")