Splunk Search

How can I append additional custom values to existing field values obtained from an inputlookup?

tehale
New Member

I have an inputlookup xy.csv which is used by multiple searches and has comma separated data. In one of my searches, I want to append a custom value of my desire say "abc" to one of fields (say myfield ) obtained from an inputlookup, keeping all the existing values. More specifically, myfield should have values as myfield=myfield and "abc". I do not want "abc" to be appended at the end of each field value, but I want 'abc' to be a value itself so I can use it furthur for dnslookup by appending domain details.

0 Karma

wpreston
Motivator

One way would be to eval your custom value ("abc") along with a delimiting character (like a comma) onto whichever field you want it to became a value of, then use makemv to make your field into a multi-value field and split the new value into two separate values of the field. Something like this:

... your base search ... | myfield=myfield.",abc" | makemv myfield delim=","

The . in the eval is just a way of concatenating the values of myfield and ",abc" together. Try this out and see if it accomplishes what you need.

Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...