Splunk Search

How can I append additional custom values to existing field values obtained from an inputlookup?

tehale
New Member

I have an inputlookup xy.csv which is used by multiple searches and has comma separated data. In one of my searches, I want to append a custom value of my desire say "abc" to one of fields (say myfield ) obtained from an inputlookup, keeping all the existing values. More specifically, myfield should have values as myfield=myfield and "abc". I do not want "abc" to be appended at the end of each field value, but I want 'abc' to be a value itself so I can use it furthur for dnslookup by appending domain details.

0 Karma

wpreston
Motivator

One way would be to eval your custom value ("abc") along with a delimiting character (like a comma) onto whichever field you want it to became a value of, then use makemv to make your field into a multi-value field and split the new value into two separate values of the field. Something like this:

... your base search ... | myfield=myfield.",abc" | makemv myfield delim=","

The . in the eval is just a way of concatenating the values of myfield and ",abc" together. Try this out and see if it accomplishes what you need.

Get Updates on the Splunk Community!

Operationalizing TDIR: Building a More Resilient, Scalable SOC

Optimizing SOC workflows with a unified, risk-based approach to Threat Detection, Investigation, and Response ...

Pro Tips for First-Time .conf Attendees: Advice from SplunkTrust

Heading to your first .Conf? You’re in for an unforgettable ride — learning, networking, swag collecting, ...

Raise Your Skills at the .conf25 Builder Bar: Your Splunk Developer Destination

Calling all Splunk developers, custom SPL builders, dashboarders, and Splunkbase app creators – the Builder ...