topic Re: How do I reference lookup table with a field that have dynamic value? in Splunk Search

How do I reference lookup table with a field that have dynamic value?

LeeZeeYuen — Fri, 19 Jan 2018 07:07:23 GMT

I have a field value for IP address in the lookup dataset but the IP address from real logs are dynamic and constantly changing.

Re: How do I reference lookup table with a field that have dynamic value?

horsefez — Fri, 19 Jan 2018 13:09:55 GMT

Hi LeeZeeYuen,
just give us a bit more description so we are able to help you.

Maybe some screenshots or example events.

Thanks!

Re: How do I reference lookup table with a field that have dynamic value?

LeeZeeYuen — Mon, 22 Jan 2018 00:08:34 GMT

This is the sample dataset I have for my lookup`

I am trying to use the lookup dataset to output the siem_severity field. The commands are as shown below

However, as you can see there are events with two output-ed "severity_level". I want an events to only display one level of severity

Re: How do I reference lookup table with a field that have dynamic value?

LeeZeeYuen — Mon, 22 Jan 2018 00:16:22 GMT

This is the dataset that I am currently using
link text

I need to use the dataset for lookup to output the field "siem_severity". The command used are shown below
link text

However, using this command will cause certain events to have two "severity_level" value
link text

I need to find a solution to only display one "severity_level" value.

Re: How do I reference lookup table with a field that have dynamic value?

FrankVl — Mon, 22 Jan 2018 09:16:42 GMT

Not sure how that comment relates to the original question (which was about dynamic IP addresses), but I see a few options to deal with getting multiple matches from your lookup:

Configure the lookup with a max. matches setting of 1 (but you may want to check whether that gives the desired match)
Use some additional commands to reduce the multi valued severity_level field to a single value field.
add more key fields to the lookup, to get a unique match

Re: How do I reference lookup table with a field that have dynamic value?

LeeZeeYuen — Mon, 22 Jan 2018 09:27:57 GMT

Haha sorry for the confusing questions. Thanks for the answer anyway I will try it out now!