Splunk Search

Is it possible for an external lookup to match on either of two fields rather than both?

jambajuice
Communicator

I'm trying to create a dashboard that will add vulnerability data from OSVDB to the results of a Nessus scan. I've created a lookup table from the content of the Nessus plugins that is like the following:

Nessus_ID,nessus_plugin_name,cve_id,osvdb_id 1,Buffer Exploit,2009-0142,, 2,Memory Overflow,,56314 3,Remote Exploit,2008-3456,34578

Some Nessus plugins only have a CVE reference. Others only have OSVDB. Some have both. Is it possible to do a lookup that will match on either cve_id, osvdb_id or both (if both are present)?

Thanks.

Craig

Tags (1)

Stephen_Sorkin
Splunk Employee
Splunk Employee

You can't do this easily with a single lookup, but you can just run both lookups, one based on CVE and one based on OSVDB and the first to match will win.

Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...