topic Re: Using multiple lookups in a search in Splunk Search

Using multiple lookups in a search

SN1 — Wed, 21 May 2025 14:59:13 GMT

hello So i want to make a search .
i am using

index=endpoint_defender source="AdvancedHunting-DeviceInfo" | rex field=DeviceName "(?<DeviceName>\w{3}-\w{1,})." | eval DeviceName=upper(DeviceName)

this gives me devicenames.

now

| lookup snow_os.csv DeviceName output OS BuildNumber Version

from this lookup i am comparing devicenames and as ouput i am getting OS BuildNumber Version.

and from these fields i want to compare them to this lookup to get whether this Operating System is outdated or not.

how can i do this ?

Re: Using multiple lookups in a search

livehybrid — Wed, 21 May 2025 15:01:16 GMT

Hi @SN1

How about

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: Using multiple lookups in a search

richgalloway — Thu, 22 May 2025 12:28:39 GMT

Add another lookup command

| lookup OS_Outdated.csv OperatingSystems as OS BuildNumber Version OUTPUT Outdated

Re: Using multiple lookups in a search

SN1 — Thu, 22 May 2025 05:07:46 GMT

i am doing this but outdated is showing nothing

Re: Using multiple lookups in a search

SN1 — Thu, 22 May 2025 05:10:49 GMT

index=endpoint_defender source="AdvancedHunting-DeviceInfo"
| rex field=DeviceName "(?<DeviceName>\w{3}-\w{1,})."
| eval DeviceName=upper(DeviceName)
| lookup snow_os.csv DeviceName output OS BuildNumber Version
| lookup OS_Outdated.csv OperatingSystems as OS BuildNumber Version OUTPUT Outdated
| fillnull value=false outdated
| table DeviceName OS BuildNumber Version Outdated

this is i am using but the problem is this line

| lookup OS_Outdated.csv OperatingSystems as OS BuildNumber Version OUTPUT Outdated

is not generating any results

Re: Using multiple lookups in a search

livehybrid — Thu, 22 May 2025 07:45:37 GMT

Please can you confirm the field names in your OS lookup?
Thanks

Re: Using multiple lookups in a search

richgalloway — Thu, 22 May 2025 12:27:18 GMT

The fields names are different between the two lookup tables. Try the modified command.

Re: Using multiple lookups in a search

bowesmana — Fri, 23 May 2025 05:09:47 GMT

The OS in your first result has OS has "Microsoft Windows 11 Enterprise", whereas your OperatingSystems field in your OS_Outdated.csv lookup does not appear to have "Microsoft" in the name, so naturally it will not match.

You will either have to make your OperatingSystems field a wildcarded lookup or massage your data so the two fields contain similar data.

You also have a small issue with your use of fillnull - you specify a field name "outdated" which is lower case, whereas your field from the lookup is Outdated (capital O)

You can try this search

index=endpoint_defender source="AdvancedHunting-DeviceInfo" | rex field=DeviceName "(?<DeviceName>\w{3}-\w{1,})." | eval DeviceName=upper(DeviceName) | lookup snow_os.csv DeviceName output OS BuildNumber Version ``` Remove the word Microsoft and any following spaces ``` | eval OperatinsSystems=replace(OS, "Microsoft\s*", "") ``` Now use this modified field as the lookup field ``` | lookup OS_Outdated.csv OperatingSystems BuildNumber Version OUTPUT Outdated | fillnull value=false Outdated | table DeviceName OS BuildNumber Version Outdated