Correlation between two different sources - Splunk 6.4.1

[cmac2001]

Hi

I am very new to Splunk and I am hoping that I can get a little help with my current problem

I have two sources - one is an RSS feed

item
titleCVE-2016-5233/title
descriptionHuawei Mate 8 smartphones with software NXT-AL10 before NXT-AL10C00B182, NXT-CL00 before NXT-CL00C92B182, NXT-DL00 before NXT-DL00C17B182, and NXT-TL00 before NXT-TL00C01B182 allow remote base stations to obtain sensitive subscriber signal strength information via vectors involving improper security status verification, aka HWPSIRT-2015-12007. (CVSS:0.0) (Last Update:2016-06-10)/description
linkhttp://www.cvedetails.com/cve/CVE-2016-5233//link
pubDate2016-06-10/pubDate
/item
item
titleCVE-2016-5126/title
descriptionHeap-based buffer overflow in the iscsi_aio_ioctl function in block/iscsi.c in QEMU allows local guest OS users to cause a denial of service (QEMU process crash) or possibly execute arbitrary code via a crafted iSCSI asynchronous I/O ioctl call. (CVSS:4.6) (Last Update:2016-06-10)/description
linkhttp://www.cvedetails.com/cve/CVE-2016-5126//link
pubDate2016-06-01/pubDate
/item

The other is a csv list

Asset
Cisco ASA 5585-X
Cisco 2951
Cisco 861
Citrix XenDesktop
Huawei AL10C00
Huawei Mate 8

What I am trying to do is;

take a field from the asset list and search for it in the RSS description - if there is a match then add a field to the RSS data called 'asset' which contains the information from the asset list - if there is no match then either 'no match' or null.

In the example a search for 'Huawei Mate 8' would find a match and a field would be added to the RSS containing 'Huawei Mate 8' as there is no match between the csvdata and the second rss feed a field would be added containing either 'no match' or null

I hope that this explains my problem and I do hope that someone can help

Many thanks

cmac

[richgalloway]

One could interpret the question as wondering how to modify an indexed event to include information from a CSV. That is not possible. Once an event is indexed it cannot be changed. The best you can do is create an automatic lookup that adds the desired field. See http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/ConfigureCSVlookups to create a lookup. Then see http://docs.splunk.com/Documentation/Splunk/6.4.1/Knowledge/Makeyourlookupautomatic for how to make the lookup automatic.

[cmac2001]

As I said I am very new to this - and I have read (and tried) various things including much of what appears on that page - all with no success.

I currently seem to have two options;

 1/.     Splunk is not the right product for my project - so I need to look for something else

 2/.     I am a little numb and I am not following the instructions correctly

If someone could point me in the right direction I would be very grateful...

NOTE - I have seen the article which says that the csv file must have two or more fields and I don't see that as much of an issue - I am more than happy to create a second field - which I assume could mirror the first field....

[richgalloway]

I think we can rule out option #1. As for option #2, we're all a little numb now and then so don't let that stop you.

Lookup files must have at least two fields so there is something to return from the lookup. If the two fields are the same then the data in the lookup must already exist in the event so the lookup is meaningless.