I have an indexed source from tanium and an inputlookup from nessus. I want to run a search that if the MAC Address matches, it returns everything in | inputlookup nessus_assets.csv and Index=tanium IF the MAC Addresses match.
Index=tanium
Computer Name | Computer Serial Number | Operating System | MAC_Address | IP_Address | Domain_Name | Last_Logged_In_User
GHI.DMZ.Local VMware-42-32-g5-23-c1-9f-5f-91-74-9f-fc-ei-0f-f1-a1-7e Windows 10 00:60:57:94:45:b8 192.158.1.53 bob.jill.net steve
DEF.DMZ.Local VMware-42-45-c5-23-c3-8f-4f-91-74-9f-fc-ey-0f-e1-e1-7d Windows 10 00:57:60:80:30:b10 192.158.1.50 bob.jill.net bill
ABC.DMZ.Local VMware-42-38-x5-24-c2-8t-4f-71-74-9f-fc-ez-0f-e1-t1-7d Windows 10 00:68:63:94:45:b11192.158.1.52 bob.jill.net lisa
| inputlookup nessus_assets.csv
IP Address | MAC Address | DNS Name | Netbios Name | Ownership
192.158.1.53 00:60:57:94:45:b8 bob.net INTERNAL\MSOFT99\BOB TESTING
192.158.1.50 00:57:60:80:30:b10 bob.net INTERNAL\MSOFT99\JILL TESTING
192.158.1.52 00:68:63:94:45:b11 bob.net INTERNAL\MSOFT99\JACK TESTING
Output of combined search I want the result to be joined if the MAC Address matches:
IP Address | MAC Address | DNS Name | Netbios Name | Ownership | Computer Name | Computer Serial Number | Operating System | Domain_Name | Last_Logged_In_User
192.158.1.53 00:60:57:94:45:b8 bob.net INTERNAL\MSOFT99\BOB TESTING GHI.DMZ.Local VMware-42-32-g5-23-c1-9f-5f-91-74-9f-fc-ei-0f-f1-a1-7e Windows 10 00:60:57:94:45:b8 192.158.1.53 bob.jill.net steve
192.158.1.50 00:57:60:80:30:b10 bob.net INTERNAL\MSOFT99\JILL TESTING DEF.DMZ.Local VMware-42-45-c5-23-c3-8f-4f-91-74-9f-fc-ey-0f-e1-e1-7d Windows 10 00:57:60:80:30:b10 192.158.1.50 bob.jill.net bill
192.158.1.52 00:68:63:94:45:b11 bob.net INTERNAL\MSOFT99\JACK TESTING ABC.DMZ.Local VMware-42-38-x5-24-c2-8t-4f-71-74-9f-fc-ez-0f-e1-t1-7d Windows 10 00:68:63:94:45:b11 192.158.1.52 bob.jill.net lisa
Any Ideas?
You can use below SPL
Index=tanium | lookup nessus_assets.csv MAC Address as MAC_Address |table
Search
index= tanium |join MAC_Address [| inputlookup nessus_assets.csv|rename "MAC Address" as MAC_Address]|table MAC_Address ..
I get the following error =(
Error in 'join' command: Usage: join ()? [subsearch]
The search job has failed due to an error. You may be able view the job in the Job Inspector.
you can do a join on the fields IP Address and MAC address from your index to the lookup.
I want to join them, but ONLY if the MAC Address matches. I believe a simple join statement won't work.
Any ideas?