Lookups on multivalued fields

[jambajuice]

I've created a lookup table that has three fields, nessus_id,osvdb_id,cve_id. The osvdb_id and cve_id fields are multivalued, delimited by a ",". So, the contents of a multivalued cve_id field in lookup table might look like: 2010-0002,2009-4583,2008-8732

I have an event that has a single value for the cve_id field. If that event has a cve_id=2009-4583 and I run a lookup on that table with an input value of cve_id and an output value of nessus_id,osvdb_id, will that lookup return the values in the table for those fields? If Splunk can run lookups on tables with multivalued fields, how do you deal with the delimter?

Thx.

Craig

[Simon]

The answer is no, it won't return values by default. Splunk doesn't automatically parse comma separated values in a single CSV column as multivalue field.
Why don't you create one line per each cve_id in the lookup table? That would be the easiest way to solve your issue.