Archive
Highlighted

Cross reference a field from an imported csv file

Engager

I currently have a csv file that contains a lot of CVE's; for example CVE-000-0001, CVE-000-0002, so on and so forth.

On another index, I have all of my nessus data which some contain CVE fields.

How can I search my nessus data and match only CVE fields that are present in the csv file?

Currently I'm doing CVE equals and then manually pasting in the CVE from the csv but that's getting a bit complicated to manage.

Tags (1)
0 Karma
Highlighted

Re: Cross reference a field from an imported csv file

SplunkTrust
SplunkTrust

This kind of thing gives you only the records from your base search that are found in the lookup file.

your base search
| fields mykey mycvefield foo
| join mycvefield [|inputcsv mycsvfile | fields othercvefield bar baz | rename othercvefield as mycvefield]
| table mykeyfield mycvefield foo bar baz

This kind of thing gives you all the records from the base search, along with the matched fields from the lookup table, if any

your base search
| fields mykey mycvefield foo
| join type=left mycvefield [|inputcsv mycsvfile | fields othercvefield bar baz | rename othercvefield as mycvefield]
| table mykeyfield mycvefield myotherfields foo bar baz
| eval bar=if(isnotnull(bar),bar,"no bar found")
| eval baz=if(isnotnull(baz),baz,"no baz found")

For some uses you want "inputlookup", for other uses you want "inputcsv". If your search is going to be run from different search heads, then it's worth the effort to officially make the csv file to be a lookup table.

View solution in original post

Highlighted

Re: Cross reference a field from an imported csv file

Engager

This worked like a charm. I had to do inputlookup since I imported it as a dataset but works great. Thank you!

0 Karma
Highlighted

Re: Cross reference a field from an imported csv file

SplunkTrust
SplunkTrust

You are quite welcome. Yes, there are nuance details about when to use lookup and when to use csv --- especially regarding local versus clustered --- but they are largely equivalent on the reporting side.

0 Karma