Splunk Enterprise Security

Create token in SPL to be used later in SPL

brownt61
Explorer

Hello,

I am attempting to create a workflow action that allows a risk modifier to be adjusted. I have the command needed to adjust the risk modifier, however I need to token the risk score that I need to adjust it by, this risk_score has to be generated earlier in the SPL that the makeresults is occuring in.

What I have already, is a search that captures the risk score that needs to be tokenized to be put into the makeresults command to adjust their overall score. This is what I am needing help with.

I have the following search

| from datamodel:"Risk"."All_Risk"
| rex field=_raw "incident_id=\"(?[^\"]*)"
| fillnull incident_id value=null
| search incident_id!=null
| search risk_object="testuser"
| table risk_object risk_score
| sort - _time

the output will give me
risk_object=testuser
risk_score=60

I then need to pipe out a makeresults command that will apply the risk_score value as a token into that makeresults command. The risk_score value needs to be generated and the token needs to be generated inside the the same SPL as workflow action that is applying the makeresults.

Thank you

0 Karma
Get Updates on the Splunk Community!

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...