Splunk Search

Can I use catch alls (wildcards) in Splunk lookups if an exact match is not found?

mark_cet
Path Finder

We have alert events coming into Splunk & Splunk ITSI that we open Service Now incidents for, but depending on the event contents the incident will need to be routed to different teams.

An example scenario is, if the alert comes from server A then set the Service Now assignment group to team A, alerts from all other servers should go to team B.

We will have many of these scenarios in our environment, what is the best way to do this?

 

Thanks in advance!

Labels (1)
0 Karma
1 Solution

yuanliu
SplunkTrust
SplunkTrust

Ah, for that, you want to use case function instead of nesting if()s. (Yes, you can nest to your heart's content.)

View solution in original post

0 Karma

yuanliu
SplunkTrust
SplunkTrust

I think you are looking for the if function, not a wildcard solution.

Suppose you have a lookup table ServiceNowAssign like the following

ServerTeam
ATeam A

 

You can set up a search like this

(your alert condition)
| lookup ServiceNowAssign Server
| eval assignTo = if(isnull(Team), "Team B", Team)
0 Karma

mark_cet
Path Finder

Thanks Yuanliu.

Can the IF function be nested in the event we have multiple conditions?

 

Regards,

Mark

 

0 Karma

yuanliu
SplunkTrust
SplunkTrust

Ah, for that, you want to use case function instead of nesting if()s. (Yes, you can nest to your heart's content.)

0 Karma

mark_cet
Path Finder

Thanks again yuanliu!

0 Karma
Get Updates on the Splunk Community!

Financial Services Industry Use Cases, ITSI Best Practices, and More New Articles ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Splunk Federated Analytics for Amazon Security Lake

Thursday, November 21, 2024  |  11AM PT / 2PM ET Register Now Join our session to see the technical ...

Splunk With AppDynamics - Meet the New IT (And Engineering) Couple

Wednesday, November 20, 2024  |  10AM PT / 1PM ET Register Now Join us in this session to learn all about ...