How to pull additional fields from a lookup that is using wildcards?

joeybagofdonuts — Tue, 21 Sep 2021 17:55:09 GMT

I'm trying to build a search that will return an event and the severity of that event. I have the events with wildcards for parts that might change and severity in a lookup.

Here's an example from my lookup
Message,Severity
*kernel: nfs: server * OK,normal
*kernel: nfs: server * not responding* still trying,critical

If I run this search I get back the results I'd like, but have no way of referencing this back to the lookup to grab severity because the Message doesn't match whats in the lookup due to the wildcards

index=os source=/var/log/messages host=linuxserver1p | rex field=_raw "(?<Message>.*)"
| search [inputlookup mylookup.csv | table Message]

Jul 28 02:15:40 linuxserverp kernel: nfs: server fixdist OK
Jul 28 01:30:37 linuxserver1p kernel: nfs: server fixdist not responding, still trying

How can I take these results back to my lookup and be able to pull severity out?

Here is another search I've tried where I have both the results I want and the values from the lookup and I just need to join them together somehow, but as far as I can tell the join won't work with wildcards

|inputlookup mylookup.csv |rename Message as msg

| append[search index=os source=/var/log/messages host=linuxserver1p | rex field=_raw "(?<Message>.*)" | search [inputlookup mylookup.csv | table Message]]

|table Message msg Severity

Re: How to pull additional fields from a lookup that is using wildcards?

richgalloway — Sat, 07 Aug 2021 13:29:05 GMT

One can use wildcards in a lookup if one defines the lookup that way. Go to Settings->Lookups and click on "Lookup definitions". Add a new definition that references mylookup.csv. Click the Advanced box and type "WILDCARD(Message)" in the "Match type" box.

Invoke the wildcard lookup with the lookup command (see the Search Reference manual for the difference between lookup and inputlookup).

index=os source=/var/log/messages host=linuxserver1p | rex field=_raw "(?<Message>.*)" | lookup mylookup Message OUTPUT Severity | table Message Severity

topic Re: How to pull additional fields from a lookup that is using wildcards? in Splunk Search

How to pull additional fields from a lookup that is using wildcards?

Re: How to pull additional fields from a lookup that is using wildcards?