- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Is it possible for an external lookup to match on either of two fields rather than both?
jambajuice
Communicator
01-12-2011
02:04 AM
I'm trying to create a dashboard that will add vulnerability data from OSVDB to the results of a Nessus scan. I've created a lookup table from the content of the Nessus plugins that is like the following:
Nessus_ID,nessus_plugin_name,cve_id,osvdb_id 1,Buffer Exploit,2009-0142,, 2,Memory Overflow,,56314 3,Remote Exploit,2008-3456,34578
Some Nessus plugins only have a CVE reference. Others only have OSVDB. Some have both. Is it possible to do a lookup that will match on either cve_id, osvdb_id or both (if both are present)?
Thanks.
Craig
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Stephen_Sorkin
![Splunk Employee Splunk Employee](/html/@F88B7774A2BF2E9108D79A067A92A581/rank_icons/employee-16.png)
Splunk Employee
01-12-2011
04:32 AM
You can't do this easily with a single lookup, but you can just run both lookups, one based on CVE and one based on OSVDB and the first to match will win.
![](/skins/images/FE4825B2128CA5F641629E007E333890/responsive_peak/images/icon_anonymous_message.png)