Splunk Enterprise Security
Highlighted

Create token in SPL to be used later in SPL

Explorer

Hello,

I am attempting to create a workflow action that allows a risk modifier to be adjusted. I have the command needed to adjust the risk modifier, however I need to token the risk score that I need to adjust it by, this risk_score has to be generated earlier in the SPL that the makeresults is occuring in.

What I have already, is a search that captures the risk score that needs to be tokenized to be put into the makeresults command to adjust their overall score. This is what I am needing help with.

I have the following search

| from datamodel:"Risk"."AllRisk"
| rex field=
raw "incidentid=\"(?[^\"]*)"
| fillnull incident
id value=null
| search incidentid!=null
| search risk
object="testuser"
| table riskobject riskscore
| sort - _time

the output will give me
riskobject=testuser
risk
score=60

I then need to pipe out a makeresults command that will apply the riskscore value as a token into that makeresults command. The riskscore value needs to be generated and the token needs to be generated inside the the same SPL as workflow action that is applying the makeresults.

Thank you

0 Karma