Splunk Search

How to Match Akamai WAF Info with Lookup Table?

richard_g_curry
Explorer

One of my business partners wants to create a search on his Akamai data taking the Rule IDs from the WAS Info field and match those to a lookup table to get the textual reference to the Rule ID code. I am not sure how to match to a lookup table when the field can have multiple values separated by ":"; such as this:

    xxxx_11111|950901:973333:973335:981173:981242:981318|

Separating the different rule IDs is a simple rex, but how do I use that multi-value field to match up against the lookup table to get all the text meanings for those codes?

0 Karma

lguinn2
Legend

I don't know how to make Splunk handle a multi-value input key, but you could do this, assuming that the field is named WAS_Info:

yoursearchhere
| makemv delim=":" WAS_Info
| mvexpand WAS_Info
| lookup your_lookup_name WAS_Info as RuleID OUTPUT RuleText

then do whatever you want...

Here is some additional info: Manipulate and Evaluate Multivalued Fields

richard_g_curry
Explorer

Thank you, this has provided just what I needed.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...