Hello,
I am using Splunk 6.2 and I am trying to use |eval cidrmatch in a search to identify a series of subnets by a common name. I am using the following:
some search highlighting individual IP's by field clientIP | eval voipnet=cidrmatch("111.111.0.0/16",clientIP) | eval tecnet=cidrmatch("222.222.0.0/16",clientIP) | eval secnet=cidrmatch("333.333.0.0/16",clientIP) | table clientIP,clientSplunkName,clientNetworkName,voipnet,tecnet,secnet | dedup clientIP
But I keep getting the error:
Error in 'eval' command: Fields cannot be assigned a boolean result. Instead, try if([bool expr], [expr], [expr])
Based on the reference documentation, it looks like my search *may have worked in v.5. Any recommendations on how to do this in version 6.2?
... View more