Splunk Search

Comparing Two Lookup Files

cgalligan
Explorer

I have two lookup files: 1) vulnerability results and 2) asset information. I want to take the vulnerability results, compare by IP to the asset information; and add device numbers to the results.

Vulnerability results (FILE 1) has a column called "IP"
Asset Information (FILE2) has columns called deviceId, POC, and scanIp.

IP and scanIp would match

Current search (which returns no results): |inputlookup FILE1|lookup FILE2 scanIp OUTPUTNEW deviceId,POC|table IP,deviceId,POC

Any ideas?

0 Karma
1 Solution

elliotproebstel
Champion

Because the field name is different in the two lookups, you'll need to use an AS clause to alias the field you're looking up. Try this:

|inputlookup FILE1|lookup FILE2 scanIp AS IP OUTPUTNEW deviceId,POC|table IP,deviceId,POC

View solution in original post

elliotproebstel
Champion

Because the field name is different in the two lookups, you'll need to use an AS clause to alias the field you're looking up. Try this:

|inputlookup FILE1|lookup FILE2 scanIp AS IP OUTPUTNEW deviceId,POC|table IP,deviceId,POC

Get Updates on the Splunk Community!

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...