Splunk Search

Comparing Two Lookup Files

cgalligan
Explorer

I have two lookup files: 1) vulnerability results and 2) asset information. I want to take the vulnerability results, compare by IP to the asset information; and add device numbers to the results.

Vulnerability results (FILE 1) has a column called "IP"
Asset Information (FILE2) has columns called deviceId, POC, and scanIp.

IP and scanIp would match

Current search (which returns no results): |inputlookup FILE1|lookup FILE2 scanIp OUTPUTNEW deviceId,POC|table IP,deviceId,POC

Any ideas?

0 Karma
1 Solution

elliotproebstel
Champion

Because the field name is different in the two lookups, you'll need to use an AS clause to alias the field you're looking up. Try this:

|inputlookup FILE1|lookup FILE2 scanIp AS IP OUTPUTNEW deviceId,POC|table IP,deviceId,POC

View solution in original post

elliotproebstel
Champion

Because the field name is different in the two lookups, you'll need to use an AS clause to alias the field you're looking up. Try this:

|inputlookup FILE1|lookup FILE2 scanIp AS IP OUTPUTNEW deviceId,POC|table IP,deviceId,POC

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...