Hi, I am getting crazy with a simply JOIN statement to use Tenable data in Splunk.
The goal is to enrich the KV store collection for Tenable.sc asset data with the baseScore of a vulnerability. that information is raw events in a dedicate sourcetype
this query gets a list of plugin_id with the baseScore
index=nessus sourcetype="tenable:sc:plugin"
| rename id as plugin_id
| table plugin_id baseScore
this query gets a some fields from that tenable KV store
| inputlookup sc_vuln_data_lookup
| fields dns_name, first_found, last_found, plugin_id,state
When I try to do a join, I simple get no results at all.
| inputlookup sc_vuln_data_lookup
| fields dns_name, first_found, last_found, plugin_id,state
| join plugin_id
[ search index=nessus sourcetype="tenable:sc:plugin"
| rename id as plugin_id
| table plugin_id baseScore]
I guess it is something simple I am missing but I am not capable to see it.
could anyone point me to the mistake?
many thanks
