Splunk Dev

Cross reference a field from an imported csv file

mcal01
Engager

I currently have a csv file that contains a lot of CVE's; for example CVE-000-0001, CVE-000-0002, so on and so forth.

On another index, I have all of my nessus data which some contain CVE fields.

How can I search my nessus data and match only CVE fields that are present in the csv file?

Currently I'm doing CVE equals and then manually pasting in the CVE from the csv but that's getting a bit complicated to manage.

Tags (1)
0 Karma
1 Solution

DalJeanis
SplunkTrust
SplunkTrust

This kind of thing gives you only the records from your base search that are found in the lookup file.

your base search
| fields mykey mycvefield foo
| join mycvefield [|inputcsv mycsvfile | fields othercvefield bar baz | rename othercvefield as mycvefield]
| table mykeyfield mycvefield foo bar baz

This kind of thing gives you all the records from the base search, along with the matched fields from the lookup table, if any

your base search
| fields mykey mycvefield foo
| join type=left mycvefield [|inputcsv mycsvfile | fields othercvefield bar baz | rename othercvefield as mycvefield]
| table mykeyfield mycvefield myotherfields foo bar baz
| eval bar=if(isnotnull(bar),bar,"no bar found")
| eval baz=if(isnotnull(baz),baz,"no baz found")

For some uses you want "inputlookup", for other uses you want "inputcsv". If your search is going to be run from different search heads, then it's worth the effort to officially make the csv file to be a lookup table.

View solution in original post

DalJeanis
SplunkTrust
SplunkTrust

This kind of thing gives you only the records from your base search that are found in the lookup file.

your base search
| fields mykey mycvefield foo
| join mycvefield [|inputcsv mycsvfile | fields othercvefield bar baz | rename othercvefield as mycvefield]
| table mykeyfield mycvefield foo bar baz

This kind of thing gives you all the records from the base search, along with the matched fields from the lookup table, if any

your base search
| fields mykey mycvefield foo
| join type=left mycvefield [|inputcsv mycsvfile | fields othercvefield bar baz | rename othercvefield as mycvefield]
| table mykeyfield mycvefield myotherfields foo bar baz
| eval bar=if(isnotnull(bar),bar,"no bar found")
| eval baz=if(isnotnull(baz),baz,"no baz found")

For some uses you want "inputlookup", for other uses you want "inputcsv". If your search is going to be run from different search heads, then it's worth the effort to officially make the csv file to be a lookup table.

mcal01
Engager

This worked like a charm. I had to do inputlookup since I imported it as a dataset but works great. Thank you!

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

You are quite welcome. Yes, there are nuance details about when to use lookup and when to use csv --- especially regarding local versus clustered --- but they are largely equivalent on the reporting side.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...