Splunk Search

Comparing Two Lookup Files

cgalligan
Explorer

I have two lookup files: 1) vulnerability results and 2) asset information. I want to take the vulnerability results, compare by IP to the asset information; and add device numbers to the results.

Vulnerability results (FILE 1) has a column called "IP"
Asset Information (FILE2) has columns called deviceId, POC, and scanIp.

IP and scanIp would match

Current search (which returns no results): |inputlookup FILE1|lookup FILE2 scanIp OUTPUTNEW deviceId,POC|table IP,deviceId,POC

Any ideas?

0 Karma
1 Solution

elliotproebstel
Champion

Because the field name is different in the two lookups, you'll need to use an AS clause to alias the field you're looking up. Try this:

|inputlookup FILE1|lookup FILE2 scanIp AS IP OUTPUTNEW deviceId,POC|table IP,deviceId,POC

View solution in original post

elliotproebstel
Champion

Because the field name is different in the two lookups, you'll need to use an AS clause to alias the field you're looking up. Try this:

|inputlookup FILE1|lookup FILE2 scanIp AS IP OUTPUTNEW deviceId,POC|table IP,deviceId,POC

Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...