Splunk Search

Matching value inside a lookup with wildcard?

zewashere
New Member

Hello, i'm new to Splunk and i need some advices.

I've created a lookup named my_color_lookup, with 2 column :

color,danger

red,high

yellow,medium

green,low

Then my base search is :

sourctype=foo AND customer_id=520.

This search returns me a quantity of event and has several fields. One of these fields is src_light.

I want to create a new field "risk_level" in my event

if src_light match with one color inside my lookup, i want my search to

- add a value low or medium or high in the new field risk_level

- leave the field risk_level if ther's no matching.

Thanks for your help and suggestions

Labels (1)
0 Karma

zewashere
New Member

one last things, i need to use wildcards for the search... the field src_light can have value like "dark yellow" or "deep red" and these colors need to match.

0 Karma
Get Updates on the Splunk Community!

Get Early Access to AI Playbook Authoring: Apply for the Alpha Private Preview ...

Passionate about security automation? Apply now to our AI Playbook Authoring Alpha private preview ...

Reduce and Transform Your Firewall Data with Splunk Data Management

Managing high-volume firewall data has always been a challenge. Noisy events and verbose traffic logs often ...

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...