Using multiple lookups in a search

[SN1]

hello So i want to make a search .
i am using 

index=endpoint_defender source="AdvancedHunting-DeviceInfo"
| rex field=DeviceName "(?<DeviceName>\w{3}-\w{1,})."
| eval DeviceName=upper(DeviceName)

this gives me devicenames.

now 

| lookup snow_os.csv DeviceName output OS BuildNumber Version

from this lookup i am comparing devicenames and as ouput i am getting OS BuildNumber Version.

and from these fields i want to compare them to this lookup to get whether this Operating System is outdated or not.

how can i do this ?

[richgalloway]

Add another lookup command

| lookup OS_Outdated.csv OperatingSystems as OS BuildNumber Version OUTPUT Outdated

[richgalloway]

The fields names are different between the two lookup tables.  Try the modified command.

[SN1]

i am doing this but outdated is showing nothing

[livehybrid]

Please can you confirm the field names in your OS lookup?
Thanks

[livehybrid]

Hi @SN1 

How about 

index=endpoint_defender source="AdvancedHunting-DeviceInfo"
| rex field=DeviceName "(?<DeviceName>\w{3}-\w{1,})."
| eval DeviceName=upper(DeviceName)
| lookup snow_os.csv DeviceName output OS BuildNumber Version
| lookup os_version_status.csv OS BuildNumber Version OUTPUT Outdated
| table DeviceName OS BuildNumber Version Outdated

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[SN1]

index=endpoint_defender source="AdvancedHunting-DeviceInfo"
| rex field=DeviceName "(?<DeviceName>\w{3}-\w{1,})."
| eval DeviceName=upper(DeviceName)
| lookup snow_os.csv DeviceName output OS BuildNumber Version
| lookup OS_Outdated.csv OperatingSystems as OS BuildNumber Version OUTPUT Outdated
| fillnull value=false outdated
| table DeviceName OS BuildNumber Version Outdated

this is i am using but the problem is this line

| lookup OS_Outdated.csv OperatingSystems as OS BuildNumber Version OUTPUT Outdated

is not generating any results

[bowesmana]

The OS in your first result has OS has "Microsoft Windows 11 Enterprise", whereas your OperatingSystems field in your OS_Outdated.csv lookup does not appear to have "Microsoft" in the name, so naturally it will not match.

You will either have to make your OperatingSystems field a wildcarded lookup or massage your data so the two fields contain similar data.

You also have a small issue with your use of fillnull - you specify a field name "outdated" which is lower case, whereas your field from the lookup is Outdated (capital O)

You can try this search

index=endpoint_defender source="AdvancedHunting-DeviceInfo"
| rex field=DeviceName "(?<DeviceName>\w{3}-\w{1,})."
| eval DeviceName=upper(DeviceName)
| lookup snow_os.csv DeviceName output OS BuildNumber Version
``` Remove the word Microsoft and any following spaces ```
| eval OperatinsSystems=replace(OS, "Microsoft\s*", "")
``` Now use this modified field as the lookup field ```
| lookup OS_Outdated.csv OperatingSystems BuildNumber Version OUTPUT Outdated
| fillnull value=false Outdated
| table DeviceName OS BuildNumber Version Outdated