Splunk Search

Dynamic field-names for lookups

Matthias_BY
Communicator

Hello,

i have a scripted lookup which is working fine. i configured in the lookups that the field name is called clientip for lookups.

now i want to make it more dynamic so that the lookup can also be used for other fields containing an ip address. those fields might be clientip, src_ip, source_ip, dst_ip, dest_ip and so on.

currently i found only that i need to configure one lookup command for each field name or rename the field in a pre command.

alt text alt text

i want to make my app ip reputation more generic. so that someone can type

... | lookup threatscore src_ip

as well as

... | lookup threatscore clientip

or other field names depending what's required.

Thanks a lot
Matthias

0 Karma
1 Solution

starcher
SplunkTrust
SplunkTrust

You could do the one lookup then just add "AS" so " | lookup threatscore ip AS src_ip" That will map the src_ip to the ip field from your lookup as you do it.

View solution in original post

starcher
SplunkTrust
SplunkTrust

You could do the one lookup then just add "AS" so " | lookup threatscore ip AS src_ip" That will map the src_ip to the ip field from your lookup as you do it.

Matthias_BY
Communicator

great this is working - so easy 😉 thanks a lot

0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

REGISTER NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more ...

Security Highlights | November 2022 Newsletter

 November 2022 2022 Gartner Magic Quadrant for SIEM: Splunk Named a Leader for the 9th Year in a RowSplunk is ...

Platform Highlights | November 2022 Newsletter

 November 2022 Skill Up on Splunk with our New Builder Tech Talk SeriesCan you build it? Yes you can! *play ...