Splunk Search

Lookups on multivalued fields

jambajuice
Communicator

I've created a lookup table that has three fields, nessus_id,osvdb_id,cve_id. The osvdb_id and cve_id fields are multivalued, delimited by a ",". So, the contents of a multivalued cve_id field in lookup table might look like: 2010-0002,2009-4583,2008-8732

I have an event that has a single value for the cve_id field. If that event has a cve_id=2009-4583 and I run a lookup on that table with an input value of cve_id and an output value of nessus_id,osvdb_id, will that lookup return the values in the table for those fields? If Splunk can run lookups on tables with multivalued fields, how do you deal with the delimter?

Thx.

Craig

Tags (2)

Simon
Contributor

The answer is no, it won't return values by default. Splunk doesn't automatically parse comma separated values in a single CSV column as multivalue field.
Why don't you create one line per each cve_id in the lookup table? That would be the easiest way to solve your issue.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...