topic Re: Can I use catch alls (wildcards) in Splunk lookups if an exact match is not found? in Splunk Search

Can I use catch alls (wildcards) in Splunk lookups if an exact match is not found?

mark_cet — Tue, 06 Sep 2022 15:49:49 GMT

We have alert events coming into Splunk & Splunk ITSI that we open Service Now incidents for, but depending on the event contents the incident will need to be routed to different teams.

An example scenario is, if the alert comes from server A then set the Service Now assignment group to team A, alerts from all other servers should go to team B.

We will have many of these scenarios in our environment, what is the best way to do this?

Thanks in advance!

Re: Can I use catch alls (wildcards) in Splunk lookups if an exact match is not found?

yuanliu — Wed, 07 Sep 2022 10:50:22 GMT

I think you are looking for the if function, not a wildcard solution.

Suppose you have a lookup table ServiceNowAssign like the following

Server	Team
A	Team A

You can set up a search like this

(your alert condition) | lookup ServiceNowAssign Server | eval assignTo = if(isnull(Team), "Team B", Team)

Re: Can I use catch alls (wildcards) in Splunk lookups if an exact match is not found?

mark_cet — Wed, 07 Sep 2022 11:05:56 GMT

Thanks Yuanliu.

Can the IF function be nested in the event we have multiple conditions?

Regards,

Mark

Re: Can I use catch alls (wildcards) in Splunk lookups if an exact match is not found?

yuanliu — Thu, 08 Sep 2022 02:31:40 GMT

Ah, for that, you want to use case function instead of nesting if()s. (Yes, you can nest to your heart's content.)

Re: Can I use catch alls (wildcards) in Splunk lookups if an exact match is not found?

mark_cet — Thu, 08 Sep 2022 13:49:33 GMT

Thanks again yuanliu!