Splunk Search

How to perform Lookup Using Event Field that is a List?

rrossetti
Splunk Employee
Splunk Employee

I have an event field that is a list of  "permissions" , and I want to perform a lookup for each permission in the list. 

E.g.

Events

name permissions
app1 send_message
app2 read_user, send_message, write_test

 

Lookup Table:

permission risk
send_message

medium

read_user

low

write_test

high

 

Desired Results

app permission risk
app1 send_message medium
app2 read_user low
app2 send_message medium
app2 write_test high




I want to split the permissions field for each app, and then use the lookup separately so that each row corresponds to an app and one of its permissions. The length of the permissions field is variable. 
I am not sure what is the most efficient way to achieve this. 

Labels (3)
0 Karma
1 Solution

PickleRick
SplunkTrust
SplunkTrust

1. Use split() function to split your string "list" into multivalued field

2. Use mvexpand to expand multivalued field into separate rows

3. Do your lookup

View solution in original post

woodcock
Esteemed Legend

|makeresults | eval _raw="
name domain
app1 google.com
app2 microsoft.com, ibm.com, apple.com"
| multikv forceheader=1
| makemv tokenizer="([^,\s]+)" domain
| mvexpand domain
| rename COMMENT AS "You may not need the above line"
| lookup dnslookup clienthost AS domain

PickleRick
SplunkTrust
SplunkTrust

1. Use split() function to split your string "list" into multivalued field

2. Use mvexpand to expand multivalued field into separate rows

3. Do your lookup

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...