Splunk Enterprise Security

Create token in SPL to be used later in SPL



I am attempting to create a workflow action that allows a risk modifier to be adjusted. I have the command needed to adjust the risk modifier, however I need to token the risk score that I need to adjust it by, this risk_score has to be generated earlier in the SPL that the makeresults is occuring in.

What I have already, is a search that captures the risk score that needs to be tokenized to be put into the makeresults command to adjust their overall score. This is what I am needing help with.

I have the following search

| from datamodel:"Risk"."All_Risk"
| rex field=_raw "incident_id=\"(?[^\"]*)"
| fillnull incident_id value=null
| search incident_id!=null
| search risk_object="testuser"
| table risk_object risk_score
| sort - _time

the output will give me

I then need to pipe out a makeresults command that will apply the risk_score value as a token into that makeresults command. The risk_score value needs to be generated and the token needs to be generated inside the the same SPL as workflow action that is applying the makeresults.

Thank you

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...