Splunk Search

How can I modify the value of a field of a search?

New Member


Could I get some advice to get the right solution to my problem, I am a Splunk newbie and my knowledge of proper search syntax is garbage, so here it goes:

I have a dashboard application where I have a table and two columns of this table can be filled by the user, this operation can be made after a search.

My question is, Which could be the best option to updated the empty fields before the search to the new value that the user filled on the table? How Could I atteched this value to the event of the search? I was reading about the lookup method but I don't understand it, and also searching about modify fields of an event but I didn't get a good answer.

Someone could help me a little?

Also Attached an image of my dashboard to explain me a little betteralt text

Thanks in advanced


Tags (2)
0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!