Splunk Search

Can I use catch alls (wildcards) in Splunk lookups if an exact match is not found?

mark_cet
Path Finder

We have alert events coming into Splunk & Splunk ITSI that we open Service Now incidents for, but depending on the event contents the incident will need to be routed to different teams.

An example scenario is, if the alert comes from server A then set the Service Now assignment group to team A, alerts from all other servers should go to team B.

We will have many of these scenarios in our environment, what is the best way to do this?

 

Thanks in advance!

Labels (1)
0 Karma
1 Solution

yuanliu
SplunkTrust
SplunkTrust

Ah, for that, you want to use case function instead of nesting if()s. (Yes, you can nest to your heart's content.)

View solution in original post

0 Karma

yuanliu
SplunkTrust
SplunkTrust

I think you are looking for the if function, not a wildcard solution.

Suppose you have a lookup table ServiceNowAssign like the following

ServerTeam
ATeam A

 

You can set up a search like this

(your alert condition)
| lookup ServiceNowAssign Server
| eval assignTo = if(isnull(Team), "Team B", Team)
0 Karma

mark_cet
Path Finder

Thanks Yuanliu.

Can the IF function be nested in the event we have multiple conditions?

 

Regards,

Mark

 

0 Karma

yuanliu
SplunkTrust
SplunkTrust

Ah, for that, you want to use case function instead of nesting if()s. (Yes, you can nest to your heart's content.)

0 Karma

mark_cet
Path Finder

Thanks again yuanliu!

0 Karma
Get Updates on the Splunk Community!

Splunk Classroom Chronicles: Training Tales and Testimonials

Welcome to the "Splunk Classroom Chronicles" series, created to help curious, career-minded learners get ...

Access Tokens Page - New & Improved

Splunk Observability Cloud recently launched an improved design for the access tokens page for better ...

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

🍂 Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...