Splunk Search

Is there a way for Lookup file to return field names?

ansif
Motivator

Is there a way to achieve this?

 

I have  a lookup table with 2 columns alert_type and short_description.

 

alert_type | short_description

cpu              | "The Host".host."cpu utilization is high".cpu_perc."%"

mem            | "The memory in the host ".host."is high with a percentage of ".mem_perc."%"

 

When alert type matches it should return short_description and the fields in the short description should replace with field values( host,cpu_perc and mem_perc)

 

Example :

The Host abcd.com cpu utilization is high 90 %

instead of a string

"The Host".host."cpu utilization is high".cpu_perc."%"

 

Labels (1)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

Yes you can do

| lookup lookup_file.csv alert_type OUTPUT short_description
| eval msg=short_description
| foreach mem_perc host cpu_perc [ eval msg=replace(msg, "<<FIELD>>", <<FIELD>>) ]

Note that here, the 'host' will get replaced twice, as there are two "host" strings. So, you may want to surround your replacement anchors with some identifer, e.g. if your description is

"The memory in the host {host} is high with a percentage of {mem_perc}%"

then use

| foreach mem_perc host cpu_perc [ eval msg=replace(msg, "{<<FIELD>>}", <<FIELD>>) ]

View solution in original post

0 Karma

bowesmana
SplunkTrust
SplunkTrust

You can't do that and, for example, use printf(short_description, ...) but you could use a series of replace statements, e.g.

| lookup lookup_file.csv alert_type OUTPUT short_description
| eval msg=replace(short_description, "mem_perc", mem_perc)
| eval msg=replace(msg, "host", host)
| eval msg=replace(msg, "cpu_perc", cpu_perc)

You could put that all in a macro if you wanted re-use and just change the macro as needed. 

0 Karma

ansif
Motivator

Is there a way to do an iterate using foreach or something to replace?

 

Like all  fields in the short_description which needs to replace is prefix with "var_" , thus a foreach to replace all var_* with *?

 

 

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Yes you can do

| lookup lookup_file.csv alert_type OUTPUT short_description
| eval msg=short_description
| foreach mem_perc host cpu_perc [ eval msg=replace(msg, "<<FIELD>>", <<FIELD>>) ]

Note that here, the 'host' will get replaced twice, as there are two "host" strings. So, you may want to surround your replacement anchors with some identifer, e.g. if your description is

"The memory in the host {host} is high with a percentage of {mem_perc}%"

then use

| foreach mem_perc host cpu_perc [ eval msg=replace(msg, "{<<FIELD>>}", <<FIELD>>) ]
0 Karma

ansif
Motivator

| makeresults
| eval host="abc.com",mem_perc="32",short_description="The memory in the host {host} is high with a percentage of {mem_perc}%"
| eval msg=short_description
| foreach host mem_perc cpu_perc
[ eval msg=replace(msg, "{<<FIELD>>}", <<FIELD>>) ]

 

The above woks however if the field is not available then it is not working. For example cpu_perc is not available above so it is showing blank in msg

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Test for null and use some standard text, i.e.

| foreach host mem_perc cpu_perc
  [ eval _tmp=if(isnotnull('<<FIELD>>'), '<<FIELD>>', "Unknown"), 
         msg=replace(msg, "{<<FIELD>>}", _tmp) 
    | fields - _tmp ]
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...