Asset lookup with conditional eval

richardphung — Wed, 30 Sep 2020 01:12:38 GMT

Greetings--
I have an asset lookup gen that begins with:

| stats latest(src_ip) as ip latest(os) as os **latest(primary_user) as owner latest(user_name) as user** latest(src_mac) as mac by client_name
| rex field=client_name "^[^\.]+\.(?P<dest_domain>.+)"
| rex field=client_name "^(?<nt_host>[^\.]+)"

However, out asset lookup fields do not contain "user":
https://docs.splunk.com/Documentation/ES/5.3.0/Admin/Formatassetoridentitylist

ip,mac,nt_host,dns,owner,priority,lat,long,city,country,bunit,category,pci_domain,is_expected,should_timesync,should_update,requires_av

When I try:

|makeresults | eval src="1.2.3.4" | get_asset(src)

It automatically puts primary_user as the owner.
However, I would ideally like it to:
Assign latest(user_name) as owner and if latest(user_name)=null, then assign latest(primary_user) as owner, and if both are $null, then to make owner default to "unknown"

I'm not sure how to include the eval latest() inside of |eval owner= case(...), etc.
Any advice would be greatly appreciated.

Re: Asset lookup with conditional eval

marycordova — Wed, 10 Jul 2019 23:18:11 GMT

|eval owner=if(isnotnull('user_name'),'user_name',(if(isnotnull('primary_user'),'primary_user',"unknown")))
| stats latest(src_ip) as ip latest(os) as os latest(owner) as owner latest(src_mac) as mac by client_name
| rex field=client_name "^[^\.]+\.(?P<dest_domain>.+)"
| rex field=client_name "^(?<nt_host>[^\.]+)"

Re: Asset lookup with conditional eval

richardphung — Thu, 11 Jul 2019 17:13:33 GMT

This worked perfectly.
Thanks!

topic Asset lookup with conditional eval in Splunk Enterprise Security

Asset lookup with conditional eval

Re: Asset lookup with conditional eval

Re: Asset lookup with conditional eval