Splunk Search

Lookup full text of Cisco event and display in new window?


I have a search time field extraction for CISCO system messages named MsgClassID. I uploaded from Manager a CISCOevt_codes.csv table. Given that the table format looks like this:

   101001,(Primary) Failover cable OK,1,alert

I would like to do a discretionary lookup from the MsgClassID field pulldown and using the value of MsgClassID against error_code, I would like to return the full discription for the event in a new window.

Haven't been able to find any examples ... Is it possible to do ?

0 Karma

Splunk Employee
Splunk Employee

Sure. That sounds like you want a basic "workflow action" (what used to be simply called "field action"):


0 Karma
Get Updates on the Splunk Community!

Tips & Tricks When Using Ingest Actions

Tune in to learn about:Large scale architecture when using Ingest ActionsRegEx performance considerations ...

Announcing Our Splunk MVPs

We are excited to announce the first cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Dashboard Studio Challenge - Learn New Tricks, Showcase Your Skills, and Win Prizes!

Reimagine what you can do with your dashboards. Dashboard Studio is Splunk’s newest dashboard builder to ...