How can i split this field into multiple columns?

marceldera — Tue, 23 Aug 2022 16:57:58 GMT

Filed name = pluginText

<plugin_output>Information about this scan :

Nessus version : 10.3.0

Nessus build : 20080

Plugin feed version : 202208222232

Scanner edition used : Nessus

Scanner OS : LINUX

Scanner distribution : es7-x86-64

Scan type : Normal

Scan name : Host_Discovery & OS_Identification

Scan policy used : 93e1da98-656c-5cd5-933b-ce6665fc0486-1939724/Host_Discovery_Scan_03292022 Scanner IP : 10.102.10.1

Port scanner(s) : nessus_syn_scanner

Port range : sc-default

Ping RTT : 11.921 ms

Thorough tests : no

Experimental tests : no

Plugin debugging enabled : no

Paranoia level : 1

Report verbosity : 1

Safe checks : yes

Optimize the test : yes

Credentialed checks : no

Patch management checks : None

Display superseded patches : yes (supersedence plugin launched)

CGI scanning : disabled

Web application tests : disabled

Max hosts : 30

Max checks : 5

Recv timeout : 5

Backports : None

Allow post-scan editing : Yes

Scan Start Date : 2021/8/10 1:55 UTC

can duration : 63 sec

</plugin_output>

Re: How can i split this field into multiple columns?

ITWhisperer — Tue, 23 Aug 2022 17:23:08 GMT

| rex field=pluginText max_match=0 "\s*(?<namevalue>[^:]+ : .+)" | streamstats count as _row | mvexpand namevalue | rex field=namevalue "(?<name>[^:]+) : (?<value>.+)" | eval {name}=value | fields - name value namevalue | stats values(*) as * by _row

Re: How can i split this field into multiple columns?

marceldera — Tue, 23 Aug 2022 19:03:15 GMT

Thank you so much, I really appreciate it. It works perfectly.

topic How can i split this field into multiple columns? in Splunk Search

How can i split this field into multiple columns?

Re: How can i split this field into multiple columns?

Re: How can i split this field into multiple columns?