Splunk Search

Matching value inside a lookup with wildcard?

zewashere
New Member

Hello, i'm new to Splunk and i need some advices.

I've created a lookup named my_color_lookup, with 2 column :

color,danger

red,high

yellow,medium

green,low

Then my base search is :

sourctype=foo AND customer_id=520.

This search returns me a quantity of event and has several fields. One of these fields is src_light.

I want to create a new field "risk_level" in my event

if src_light match with one color inside my lookup, i want my search to

- add a value low or medium or high in the new field risk_level

- leave the field risk_level if ther's no matching.

Thanks for your help and suggestions

Labels (1)
0 Karma

zewashere
New Member

one last things, i need to use wildcards for the search... the field src_light can have value like "dark yellow" or "deep red" and these colors need to match.

0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with Paul Stout

Welcome to our very first developer spotlight release series where we'll feature some awesome Splunk ...

State of Splunk Careers 2024: Maximizing Career Outcomes and the Continued Value of ...

For the past four years, Splunk has partnered with Enterprise Strategy Group to conduct a survey that gauges ...

Data-Driven Success: Splunk & Financial Services

Splunk streamlines the process of extracting insights from large volumes of data. In this fast-paced world, ...