Nope, 'case' command does not support wildcard, it will work for exact match. You can change it in the string like - "132.132.132.132/16"
if you want to capture count of all subnet 16, in that case 'match' command should be used with 'case'. You have
http://docs.splunk.com/Documentation/Splunk/7.2.0/SearchReference/ConditionalFunctions#match.28SUBJECT.2C_.22REGEX.22.29
eval ips = case(match(terminal, ".+/16"), "Fld1", match(terminal, ".+/24"),"Fld2")
Correction in my 1st answer, changed = to ==
... View more