Splunk Search

Is it possible for an external lookup to match on either of two fields rather than both?

jambajuice
Communicator

I'm trying to create a dashboard that will add vulnerability data from OSVDB to the results of a Nessus scan. I've created a lookup table from the content of the Nessus plugins that is like the following:

Nessus_ID,nessus_plugin_name,cve_id,osvdb_id 1,Buffer Exploit,2009-0142,, 2,Memory Overflow,,56314 3,Remote Exploit,2008-3456,34578

Some Nessus plugins only have a CVE reference. Others only have OSVDB. Some have both. Is it possible to do a lookup that will match on either cve_id, osvdb_id or both (if both are present)?

Thanks.

Craig

Tags (1)

Stephen_Sorkin
Splunk Employee
Splunk Employee

You can't do this easily with a single lookup, but you can just run both lookups, one based on CVE and one based on OSVDB and the first to match will win.

Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...