Splunk Enterprise Security

Create token in SPL to be used later in SPL

Explorer

Hello,

I am attempting to create a workflow action that allows a risk modifier to be adjusted. I have the command needed to adjust the risk modifier, however I need to token the risk score that I need to adjust it by, this risk_score has to be generated earlier in the SPL that the makeresults is occuring in.

What I have already, is a search that captures the risk score that needs to be tokenized to be put into the makeresults command to adjust their overall score. This is what I am needing help with.

I have the following search

| from datamodel:"Risk"."All_Risk"
| rex field=_raw "incident_id=\"(?[^\"]*)"
| fillnull incident_id value=null
| search incident_id!=null
| search risk_object="testuser"
| table risk_object risk_score
| sort - _time

the output will give me
risk_object=testuser
risk_score=60

I then need to pipe out a makeresults command that will apply the risk_score value as a token into that makeresults command. The risk_score value needs to be generated and the token needs to be generated inside the the same SPL as workflow action that is applying the makeresults.

Thank you

0 Karma