Hello, i'm new to Splunk and i need some advices. I've created a lookup named my_color_lookup, with 2 column : color,danger red,high yellow,medium green,low Then my base search is : sourctype=foo AND customer_id=520. This search returns me a quantity of event and has several fields. One of these fields is src_light. I want to create a new field "risk_level" in my event if src_light match with one color inside my lookup, i want my search to - add a value low or medium or high in the new field risk_level,  - leave the field risk_level if ther's no matching. Thanks for your help and suggestions ... View more