Splunk Search

Lookups on multivalued fields

jambajuice
Communicator

I've created a lookup table that has three fields, nessus_id,osvdb_id,cve_id. The osvdb_id and cve_id fields are multivalued, delimited by a ",". So, the contents of a multivalued cve_id field in lookup table might look like: 2010-0002,2009-4583,2008-8732

I have an event that has a single value for the cve_id field. If that event has a cve_id=2009-4583 and I run a lookup on that table with an input value of cve_id and an output value of nessus_id,osvdb_id, will that lookup return the values in the table for those fields? If Splunk can run lookups on tables with multivalued fields, how do you deal with the delimter?

Thx.

Craig

Tags (2)

Simon
Contributor

The answer is no, it won't return values by default. Splunk doesn't automatically parse comma separated values in a single CSV column as multivalue field.
Why don't you create one line per each cve_id in the lookup table? That would be the easiest way to solve your issue.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...