Missing a comma after first match, this should help
sourcetype="test" severity="critical"
| iplocation src prefix=start_
| iplocation dest prefix=end_
| search start_Country="*" end_Country="*"
| table start_lat start_lon end_lat end_lon app
| eval animate="yes", pulse_at_start="yes"
| eval color = case (
match(app, "ssh"), "#c0392b",
match(app, "web-browsing"), "#e67e22",
match(app, "unknown-tcp"), "#f1c40f",
match(app, "webdav"), "#27ae60",
1==1, "#7f8c8d")
Additionally, one useful thing for formatting your queries, if you press CTRL and \ at the same time while in the search window, your query gets automatically formatted to be readable, try it out, it makes troubleshooting queries a lot easier.
... View more