Splunk Search

Adding a field to the table Lookup if there is no value

nalia_v
Loves-to-Learn Everything

Hello community.

There were a lot of questions of cases with lookups, but something among them I did not find my answer.

There is a table in Lookup - fgt_policy. 

The column1- is the policy number (field cfgobj in logs) and the column2- policy name.

fgtpol.jpg

The essence of the search query is that as soon as the policy is changed on the firewall, an allergy is triggered. There is no policy name in the firewall logs themselves, there is only a field with a number, so I created a table where I transferred all the names of our policies. Also, if a new code appears in the policy field (cfgobj), add it to the table fgt_policy. But in the current result, output only known event codes (cfgobj) with the name of the policy

Field in the firewall log with policy event code -cfgobj

So far it looks like this. The result also includes those codes for which the description in the column2 is not yet. 

fgtpol_1.jpg

I will add the name of the policy to the table with my hands when new codes appear in the field cfgobj.

Labels (1)
0 Karma

twesty
Path Finder

You can break this down into 3 parts

part 1 > run the inputlookup
part 2 > run your search to get the values you dont already have

you seem to have done this already but you just need to do it in the same search. Either a union or inputlookup > append [search] will work. Just make sure that your results contain the output from the lookup furst

then you need to merge the two results together stats first("Column 2") as "Column 2"  by "Column 1". This will update the rows which do not contain a value in column 2 but will leave the current values as-is.

Then you just need to run an outputlookup for the lookup file and you're done.  

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...