Splunk Enterprise Security

How can I make my search against lookup table case insensitive?

tromero3
Path Finder

I have a search which is detecting when host stops sending logs, then the search does a lookup against my assets lookup table file which is a KV store lookup to fetch the bunit and priority of the particular asset. The search works when the capitalization matches between the search results and the lookup table, but if they do not match exactly it will not fetch the bunit or priority. How can I make my search case insensitive so that it is able to match regardless of capitalization?

This is my search:
| metadata type=hosts index=* | where relative_time(now(), "-1d") > lastTime | convert ctime(lastTime) as Latest_Time | sort -lastTime | table host,Latest_Time | lookup assets.csv nt_host AS host OUTPUTNEW priority AS priority,bunit AS bunit | rename Latest_Time AS "Last Time Reported"

Thank you!

0 Karma

efavreau
Motivator

@tromero3
One way would be to evaluate your fields after your lookup and convert it to the same case. Most people evaluate to all lowercase. Example: | eval nt_host = lower(nt_host)

###

If this reply helps you, an upvote would be appreciated.
0 Karma

starcher
SplunkTrust
SplunkTrust

you should use the ES macro for assets not reference a csv directly. Referencing a file directly ALSO bypasses all lookup configuration like case insensitive.

https://docs.splunk.com/Documentation/ES/6.0.0/Admin/Verifyassetandidentitydata

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...