Cross reference a field from an imported csv file

[mcal01]

I currently have a csv file that contains a lot of CVE's; for example CVE-000-0001, CVE-000-0002, so on and so forth.

On another index, I have all of my nessus data which some contain CVE fields.

How can I search my nessus data and match only CVE fields that are present in the csv file?

Currently I'm doing CVE equals and then manually pasting in the CVE from the csv but that's getting a bit complicated to manage.

[DalJeanis · Accepted solution]

This kind of thing gives you only the records from your base search that are found in the lookup file.

your base search
| fields mykey mycvefield foo
| join mycvefield [|inputcsv mycsvfile | fields othercvefield bar baz | rename othercvefield as mycvefield]
| table mykeyfield mycvefield foo bar baz

This kind of thing gives you all the records from the base search, along with the matched fields from the lookup table, if any

your base search
| fields mykey mycvefield foo
| join type=left mycvefield [|inputcsv mycsvfile | fields othercvefield bar baz | rename othercvefield as mycvefield]
| table mykeyfield mycvefield myotherfields foo bar baz
| eval bar=if(isnotnull(bar),bar,"no bar found")
| eval baz=if(isnotnull(baz),baz,"no baz found")

---

For some uses you want "inputlookup", for other uses you want "inputcsv". If your search is going to be run from different search heads, then it's worth the effort to officially make the csv file to be a lookup table.

[mcal01]

This worked like a charm. I had to do inputlookup since I imported it as a dataset but works great. Thank you!

[DalJeanis]

You are quite welcome. Yes, there are nuance details about when to use lookup and when to use csv --- especially regarding local versus clustered --- but they are largely equivalent on the reporting side.