Splunk Search

Is it possible for an external lookup to match on either of two fields rather than both?


I'm trying to create a dashboard that will add vulnerability data from OSVDB to the results of a Nessus scan. I've created a lookup table from the content of the Nessus plugins that is like the following:

Nessus_ID,nessus_plugin_name,cve_id,osvdb_id 1,Buffer Exploit,2009-0142,, 2,Memory Overflow,,56314 3,Remote Exploit,2008-3456,34578

Some Nessus plugins only have a CVE reference. Others only have OSVDB. Some have both. Is it possible to do a lookup that will match on either cve_id, osvdb_id or both (if both are present)?



Tags (1)

Splunk Employee
Splunk Employee

You can't do this easily with a single lookup, but you can just run both lookups, one based on CVE and one based on OSVDB and the first to match will win.

Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...