Splunk Enterprise Security: How to associate business software to an asset?

[edhealea]

I have a .csv which contains a list of business applications, the app owner, the server(hostname or same as nt_host) the app is installed on and the software's risk rating.
What I need to do is take the application(s) and the app owner(s) and associate them to the nt_host in our assets.
I currently have the file installed as a lookup but not sure how to proceed.

[Richfez]

The regular Splunk tutorial may or may not have an example (I don't know for sure), but here's one that you can follow to get a reasonable example of how to do these things.

A close reading of the docs for lookup may also suggest at least things to try.

One thing you might need to do is make sure you have a field to join them up on - nt_host is fine, but it would have to be on both sides (not necessarily with the same name - just the contents.)

... | lookup TheNameOfMyLookup FieldInLookup1 AS FieldNameInEvent1 OUTPUT appowner AS MyNewAppOwnerName application AS MyNewApplicationName

It's just a sample, but hopefully this gets you started.

Happy Splunking,
Rich