Splunk Enterprise Security

How do I use an eval where the final value is pulled out of a lookup file?

jacqu3sy
Path Finder

How do I use an eval where the final value is pulled out of a lookup file.?

Trying to use the following but cant get it to work;

| eval severity=if( | inputlookup severity_values.csv dest OUTPUT severity),"medium","high")
|Stats count by dest, severity

With a csv that looks as follows;

dest, severity
server1, high
server2, medium
server3, low

Thanks.

0 Karma

jacobpevans
Motivator

Greetings @jacqu3sy,

Assuming you have a field called dest in your events, try this:

| lookup severity_values.csv dest as dest
| stats count by dest, severity
Cheers,
Jacob

If you feel this response answered your question, please do not forget to mark it as such. If it did not, but you do have the answer, feel free to answer your own post and accept that as the answer.
0 Karma

jacqu3sy
Path Finder

This will not allow me to OUTPUT the severity field, nor function within an IF statement as required.

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>