topic Suggestions for Tenable .csv field extraction in Splunk Search

Suggestions for Tenable .csv field extraction

Minasdad — Mon, 18 Jul 2022 13:55:42 GMT

Within the tenable:sc:vuln sourcetype there is a particular field "PluginText" that has a value for hardware serial numbers. Overall I'm looking for any source type that provides that data, but extracting "SerialNumber" as a field from "PluginText" is frustrating. Any advice would be appreciated.

Re: Tenable .csv field extraction

yuanliu — Sun, 17 Jul 2022 23:18:35 GMT

Pro tip:

Do not use deeply vertical/industry specific/application specific terms in title.
When using such specific sources, illustrate sample data (sanitize as necessary). This is a Splunk board, most people will not know what tenable:sc:vuln look like. (Source type also has no general meaning outside that particular application.)

Re: Suggestions for Tenable .csv field extraction

Minasdad — Mon, 18 Jul 2022 17:56:01 GMT

Sample Data:

pluginText: <plugin_output>

Computer Manufacturer : XXX

Computer SerialNumber : VMware- XXX

Computer Type : Other Computer

</plugin_output>

I wish to extract only the Computer Serial Number Field.

Re: Suggestions for Tenable .csv field extraction

yuanliu — Mon, 18 Jul 2022 18:07:40 GMT

Can you explain the frustration you had when trying to extract? Assuming that pluginText is already extracted into a field, you can do something like

| spath input=pluginText ``` this gives you a field plugin_output ``` | rex field=plugin_output "Computer SerialNumber: (?<serialNumber>.+)"

Alternatively, extract all key-value pairs from plugin_output using

| spath input=pluginText ``` this gives you a field plugin_output ``` | rename _raw AS saved_raw, plugin_output AS _raw | kv kvdelim=" : " | rename saved_raw as _raw