Splunk Search

Dynamic field-names for lookups

Matthias_BY
Communicator

Hello,

i have a scripted lookup which is working fine. i configured in the lookups that the field name is called clientip for lookups.

now i want to make it more dynamic so that the lookup can also be used for other fields containing an ip address. those fields might be clientip, src_ip, source_ip, dst_ip, dest_ip and so on.

currently i found only that i need to configure one lookup command for each field name or rename the field in a pre command.

alt text alt text

i want to make my app ip reputation more generic. so that someone can type

... | lookup threatscore src_ip

as well as

... | lookup threatscore clientip

or other field names depending what's required.

Thanks a lot
Matthias

0 Karma
1 Solution

starcher
SplunkTrust
SplunkTrust

You could do the one lookup then just add "AS" so " | lookup threatscore ip AS src_ip" That will map the src_ip to the ip field from your lookup as you do it.

View solution in original post

starcher
SplunkTrust
SplunkTrust

You could do the one lookup then just add "AS" so " | lookup threatscore ip AS src_ip" That will map the src_ip to the ip field from your lookup as you do it.

View solution in original post

Matthias_BY
Communicator

great this is working - so easy 😉 thanks a lot

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!