If/then in lookup table match

[wweiland]

I'm trying to use a lookup table in my search. In the nmap event, I'm given a host and port. I have a lookup table that has host, port, and service. For services such as 22 (SSH) that are a given across all systems, I want to use a * as the host so I don't have to enter all the systems into the lookup table. For more rare known services I want to use the actual hostname in the lookup table.

Is it possible to tell the search to match in the lookup table for the host first and if it doesn't find it then try to match the * value? Is there a better way of doing this?

Thanks,
Todd

[kaufmanm · Accepted solution]

You can leave the host value blank to signify a generic or common service, and then use two lookups to get what you want.

services.csv
host,port,service
,22,ssh
splunk01,8089,splunk_management

• | lookup services port OUTPUT service | lookup services host port OUTPUT service

You might have to output to a different field and then merge them to get it to work, but I imagine the second lookup will overwrite in cases where this host has a special port 22 defined and leave the original value otherwise. The key is you can use your lookup file without specifying a host.

[wweiland]

the 2nd lookup did overwrite the 1st lookup so I did have to separate out.

| lookup asset_service_list host as default port as dest_port OUTPUT service as service1 | lookup asset_service_list host as dest_host port as dest_port OUTPUT service as service2 | eval service=if(isnull(service2),service1,service2)

Thanks again for the help!!