Hello, i'm new to Splunk and i need some advices.
I've created a lookup named my_color_lookup, with 2 column :
color,danger
red,high
yellow,medium
green,low
Then my base search is :
sourctype=foo AND customer_id=520.
This search returns me a quantity of event and has several fields. One of these fields is src_light.
I want to create a new field "risk_level" in my event
if src_light match with one color inside my lookup, i want my search to
- add a value low or medium or high in the new field risk_level,
- leave the field risk_level if ther's no matching.
Thanks for your help and suggestions
one last things, i need to use wildcards for the search... the field src_light can have value like "dark yellow" or "deep red" and these colors need to match.