A public-health clinic EDR stores file hashes in uppercase, but the county ISAC intel lookup table is lowercase, so known malware hashes return no matches. What should the analyst do before the lookup?
Select an answer to reveal the explanation.
Short Explanation
Lookups are as picky as a clinic chart rack that only finds a folder if the spelling matches. If EDR writes DEADBEEF and the ISAC list has deadbeef, eval lower() — plus a type cast when the fields disagree — makes the keys shake hands before lookup runs.
Full Explanation
Splunk lookups match on exact field values, including case and type. When endpoint telemetry stores hashes in a different case or as a different type than the threat-intel table, the lookup returns no hits even for known indicators. Applying eval functions such as lower(), tostring(), or tonumber() normalizes the join key immediately before lookup. Switching to tstats or rex does not fix the key mismatch, and makeresults does not search clinic EDR events.