Splunk Search

How to compare 2 fields in an index to 1 field in a lookup?

ashishlal82
Explorer

I have a field named HASH which contains hash values and I would like to compare it to md5 and sha256 (name of the other 2 fields) in another index. I am trying to compare in Automatic Lookups, and the input fields in the automatic lookups have the HASH field name as my input value to compare against md5 and sha256.

Any suggestions ?

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi ashishlal82,

create an eval based calculated field http://docs.splunk.com/Documentation/Splunk/6.4.1/Knowledge/definecalcfields for the sourcetype of the events that contain the md5 and/or sha256 fields. The eval you could use for the calculated field could be this:

 EVAL-HASH = coalesce(HASH, md5, sha256)

the eval will either use the value of HASH or md5 or sha256 for the calculated field called HASH. Apply the automatic lookup on the field HASH and should provide the result.

Hope this helps ...

cheers, MuS

Update:
If the calculated field approach is not doable for you try this search:

your base search here to get md5 OR sha256 
| eval HASH = coalesce(HASH, md5, sha256) 
| lookup YourLookupNameHere HASH | do more ....
0 Karma

ashishlal82
Explorer

I am not sure if I followed you.
Again, I have a .csv file with columns HASH, allow_or_deny, hash_type as lookup input and I am comparing HASH in the .csv file with another datasource which has data fields as md5 and sha256. I cannot use automatic lookup, since I am trying to accomplish one(HASH) to many comparision(md5 and sha256) . is this is do able? any other solution that would work?

0 Karma

MuS
SplunkTrust
SplunkTrust

Update ping for the answer

0 Karma

ashishlal82
Explorer

your base search here to get md5 OR sha256
| eval HASH = coalesce(HASH, md5, sha256)
| lookup YourLookupNameHere HASH | do more ....

I am using md5 and sha256 as one of the comparing field in the automatic lookup
so my automatic lookup looks like
hash = sha256
hash = md5

Output all "allow" and "deny" if satisfy the equation

0 Karma

MuS
SplunkTrust
SplunkTrust

Did you read the link provide about the calculated fields? This is one way to go for you....

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...