Splunk Search

Comparing Two Lookup Files

cgalligan
Explorer

I have two lookup files: 1) vulnerability results and 2) asset information. I want to take the vulnerability results, compare by IP to the asset information; and add device numbers to the results.

Vulnerability results (FILE 1) has a column called "IP"
Asset Information (FILE2) has columns called deviceId, POC, and scanIp.

IP and scanIp would match

Current search (which returns no results): |inputlookup FILE1|lookup FILE2 scanIp OUTPUTNEW deviceId,POC|table IP,deviceId,POC

Any ideas?

0 Karma
1 Solution

elliotproebstel
Champion

Because the field name is different in the two lookups, you'll need to use an AS clause to alias the field you're looking up. Try this:

|inputlookup FILE1|lookup FILE2 scanIp AS IP OUTPUTNEW deviceId,POC|table IP,deviceId,POC

View solution in original post

elliotproebstel
Champion

Because the field name is different in the two lookups, you'll need to use an AS clause to alias the field you're looking up. Try this:

|inputlookup FILE1|lookup FILE2 scanIp AS IP OUTPUTNEW deviceId,POC|table IP,deviceId,POC

Get Updates on the Splunk Community!

Index This | What did the zero say to the eight?

June 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...