Splunk Search

Comparing Two Lookup Files

cgalligan
Explorer

I have two lookup files: 1) vulnerability results and 2) asset information. I want to take the vulnerability results, compare by IP to the asset information; and add device numbers to the results.

Vulnerability results (FILE 1) has a column called "IP"
Asset Information (FILE2) has columns called deviceId, POC, and scanIp.

IP and scanIp would match

Current search (which returns no results): |inputlookup FILE1|lookup FILE2 scanIp OUTPUTNEW deviceId,POC|table IP,deviceId,POC

Any ideas?

0 Karma
1 Solution

elliotproebstel
Champion

Because the field name is different in the two lookups, you'll need to use an AS clause to alias the field you're looking up. Try this:

|inputlookup FILE1|lookup FILE2 scanIp AS IP OUTPUTNEW deviceId,POC|table IP,deviceId,POC

View solution in original post

elliotproebstel
Champion

Because the field name is different in the two lookups, you'll need to use an AS clause to alias the field you're looking up. Try this:

|inputlookup FILE1|lookup FILE2 scanIp AS IP OUTPUTNEW deviceId,POC|table IP,deviceId,POC

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...