rex and sed with automatic lookups

[christoffertoft]

Hi,

This is basically a question of when automatic lookups are applied to data.

I have a field url i need to sed and then use an automatic lookup to assert whether the sed-ed url is in the list. What are the steps I need to take?
Is it easier to use the | lookup command after the sed pipe?

Ideally i have a search that runs the rex on url and then look for a lookup value that exists in the row for the value of that url in the lookup. If this is found, I know that the automatic lookup matched my rexed field.

[woodcock]

You need this:
https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Searchtimeoperationssequence

So what you need to do is create Calculated Field using the replace() function (instead of | rex mode=sed to create the field that you need and then setup an Automatic Lookup and it will work just fine. If this is for the purpose of CIM-compliance, you must make it automatic (not in your search's SPL).

[somesoni2]

See this:

https://docs.splunk.com/Documentation/Splunk/7.2.4/Knowledge/Searchtimeoperationssequence#Search-tim...