Splunk Search

How to use field name as the value passed into a lookup table?

TobiasBoone
Communicator
| foreach p* [eval val='<>' | lookup wkst_risk_control asset_risk_position AS 'val']

I have 19 separate p extraction fields called p0-p18. I am looking to loop through each of the field names called p* and do a lookup of the name of the field itself from the lookup table wkst_risk_control to get the supplemental data. I am struggling and missing something. Is foreach the best way or is there a more elegant method?

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Something like this should work

...| foreach p* [ lookup wkst_risk_control asset_risk_position AS "<<FIELD>>"]
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...