How do you use the lookup value as a variable?

[lozarich007]

Hi,

I have the following lookup, which is basically a mapping lookup:
lookup name: "scoring_rules"

source , field_to_use , aggregated_risk_layer
"many FW alerts",src,L1
"virus found", dest,L1
"direct ssh connection",target_ip,L1

i have the following rows under index=notable and I want to get the marked field according to the lookup mapping:

 search_name="many FW alerts" src=**10.0.0.1** dest=10.0.0.2 target_ip=192.168.0.121  action=allow
 search_name="virus found" src=10.0.0.1 dest=**10.0.0.2** target_ip=192.168.0.121  action=allow
 search_name="direct ssh connection" src=10.0.0.1 dest=10.0.0.2 target_ip=**192.168.0.121**  action=allow

Now, I want the lookup value to be the variable to assign the value from the _raw with the relevant mapped field. something like that:

index=notable search_name=*
| lookup local=true search_name source as search_name 
| eval src=field_to_use.value_from_lookup_to_be_the_var

[henriquelinsmey]

Hi lozarich007,
Have you worked out the solution for your case? I have the same scenario here and looking for assistance.

[martin_mueller]

You can cheat using foreach:

base search OR'ing all thse variations
| lookup search_name source as search_name
| foreach src dest target_ip and all other fields your lookup can refer to, or * if you want to be lazy
  [eval output = if(field_to_use="<<FIELD>>", '<<FIELD>>', output)]
| do stuff with the output field