Splunk Search

How to use field name as the value passed into a lookup table?

TobiasBoone
Communicator
| foreach p* [eval val='<>' | lookup wkst_risk_control asset_risk_position AS 'val']

I have 19 separate p extraction fields called p0-p18. I am looking to loop through each of the field names called p* and do a lookup of the name of the field itself from the lookup table wkst_risk_control to get the supplemental data. I am struggling and missing something. Is foreach the best way or is there a more elegant method?

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Something like this should work

...| foreach p* [ lookup wkst_risk_control asset_risk_position AS "<<FIELD>>"]
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...