Splunk Search

limit to case function?

Yarsa
Path Finder

Hi this is a simple case query I ran on splunk

... | eval country=case(country="US","USA",country="CA","CA","rest")

For some reason splunk doesn't like it, is it because there is a limit to the case?

thanks for the help

Tags (2)
0 Karma
1 Solution

Ayn
Legend

You're not specifying a condition for your last term, "rest". case needs a boolean condition to be specified for each outcome it's supposed to act on. If you want a "default" kind of condition, you could specify something that you know always to be true (1=1 for instance) as the last term because case will evaluate the statements sequentially.

... | eval country=case(country="US","USA",country="CA","CA",1=1,"rest")

View solution in original post

Ayn
Legend

You're not specifying a condition for your last term, "rest". case needs a boolean condition to be specified for each outcome it's supposed to act on. If you want a "default" kind of condition, you could specify something that you know always to be true (1=1 for instance) as the last term because case will evaluate the statements sequentially.

... | eval country=case(country="US","USA",country="CA","CA",1=1,"rest")
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...

Secure Your Future: Mastering Upgrade Readiness for Splunk 10

Spotlight: The Splunk Health Assistant Add-On  The Splunk Health Assistant Add-On is your ultimate companion ...

Observability Unlocked: Kubernetes & Cloud Monitoring with Splunk IM

Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team on ...