Splunk Enterprise Security

Create token in SPL to be used later in SPL

brownt61
Explorer

Hello,

I am attempting to create a workflow action that allows a risk modifier to be adjusted. I have the command needed to adjust the risk modifier, however I need to token the risk score that I need to adjust it by, this risk_score has to be generated earlier in the SPL that the makeresults is occuring in.

What I have already, is a search that captures the risk score that needs to be tokenized to be put into the makeresults command to adjust their overall score. This is what I am needing help with.

I have the following search

| from datamodel:"Risk"."All_Risk"
| rex field=_raw "incident_id=\"(?[^\"]*)"
| fillnull incident_id value=null
| search incident_id!=null
| search risk_object="testuser"
| table risk_object risk_score
| sort - _time

the output will give me
risk_object=testuser
risk_score=60

I then need to pipe out a makeresults command that will apply the risk_score value as a token into that makeresults command. The risk_score value needs to be generated and the token needs to be generated inside the the same SPL as workflow action that is applying the makeresults.

Thank you

0 Karma
Get Updates on the Splunk Community!

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...

Admin Console: A Single, Unified Interface for All Your Cloud Admin Needs

WATCH NOWJoin us to learn how the admin console can save you time and give you more control over the Splunk® ...