splunk - 使用通配符搜索 IP 地址的 splunk 案例

Question

你能帮我下面的..

index=xyz 
| eval BlockedStatus =  
case(Like(src,"14.19.106.%") AND blocked=1 ,"Q Blocked", 
            Like(src,"150.29.121.%") AND blocked=1,"Q Blocked",
            Like(src,"14.19.106.%") AND blocked=0,"Q Not Blocked", 
            Like(src,"150.29.121.%") AND blocked=0,"Q Not Blocked",
            NOT Like(src,"14.19.106.%") AND blocked=1,"Non Q Blocked", 
            NOT Like(src,"150.29.121.%") AND blocked=1,"Non Q Blocked",
            NOT Like(src,"14.19.106.%") AND blocked=0,"Non Q Not Blocked", 
            NOT Like(src,"150.29.121.%") AND blocked=0,"Non Q Not Blocked")            
| stats count by eventtype BlockedStatus 
| rename eventtype as "Local Market", count as "Total Critical Events"

因为我们有 wheresrc=150.29.121.23和blocked=1以上查询的数据，所以结果为

"Non Q Blocked" instead of "Q Blocked" 

不知道这里出了什么问题

Answer 1

您的数据与问题中的某些内容必须有所不同，因为该查询在我的沙箱中有效。