Splunk Search

How to Match Akamai WAF Info with Lookup Table?

richard_g_curry
Explorer

One of my business partners wants to create a search on his Akamai data taking the Rule IDs from the WAS Info field and match those to a lookup table to get the textual reference to the Rule ID code. I am not sure how to match to a lookup table when the field can have multiple values separated by ":"; such as this:

    xxxx_11111|950901:973333:973335:981173:981242:981318|

Separating the different rule IDs is a simple rex, but how do I use that multi-value field to match up against the lookup table to get all the text meanings for those codes?

0 Karma

lguinn2
Legend

I don't know how to make Splunk handle a multi-value input key, but you could do this, assuming that the field is named WAS_Info:

yoursearchhere
| makemv delim=":" WAS_Info
| mvexpand WAS_Info
| lookup your_lookup_name WAS_Info as RuleID OUTPUT RuleText

then do whatever you want...

Here is some additional info: Manipulate and Evaluate Multivalued Fields

richard_g_curry
Explorer

Thank you, this has provided just what I needed.

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...