Hello,
I am attempting to create a workflow action that allows a risk modifier to be adjusted. I have the command needed to adjust the risk modifier, however I need to token the risk score that I need to adjust it by, this risk_score has to be generated earlier in the SPL that the makeresults is occuring in.
What I have already, is a search that captures the risk score that needs to be tokenized to be put into the makeresults command to adjust their overall score. This is what I am needing help with.
I have the following search
| from datamodel:"Risk"."All_Risk"
| rex field=_raw "incident_id=\"(?[^\"]*)"
| fillnull incident_id value=null
| search incident_id!=null
| search risk_object="testuser"
| table risk_object risk_score
| sort - _time
the output will give me
risk_object=testuser
risk_score=60
I then need to pipe out a makeresults command that will apply the risk_score value as a token into that makeresults command. The risk_score value needs to be generated and the token needs to be generated inside the the same SPL as workflow action that is applying the makeresults.
Thank you
