Splunk Search
Highlighted

Dynamic field-names for lookups

Communicator

Hello,

i have a scripted lookup which is working fine. i configured in the lookups that the field name is called clientip for lookups.

now i want to make it more dynamic so that the lookup can also be used for other fields containing an ip address. those fields might be clientip, srcip, sourceip, dstip, destip and so on.

currently i found only that i need to configure one lookup command for each field name or rename the field in a pre command.

alt text alt text

i want to make my app ip reputation more generic. so that someone can type

... | lookup threatscore src_ip

as well as

... | lookup threatscore clientip

or other field names depending what's required.

Thanks a lot
Matthias

0 Karma
Highlighted

Re: Dynamic field-names for lookups

SplunkTrust
SplunkTrust

You could do the one lookup then just add "AS" so " | lookup threatscore ip AS srcip" That will map the srcip to the ip field from your lookup as you do it.

View solution in original post

Highlighted

Re: Dynamic field-names for lookups

Communicator

great this is working - so easy 😉 thanks a lot

0 Karma