topic Re: I need to put 4 field in table view but some field have long sentence so the table view was in organize. in Splunk Search

How to put 4 field in table view but some field have long sentence so the table view was in organize?

karu0711 — Tue, 29 Nov 2022 18:08:16 GMT

I use mvzip command

what I use above command I get all 3 field value in flaw field separated by commons instead of their own field.
what I am doing wrong

Re: I need to put 4 field in table view but some field have long sentence so the table view was in organize.

ITWhisperer — Tue, 29 Nov 2022 18:01:56 GMT

The default separator inserted by the mvzip command is a comma, so try splitting by comma

| eval nested_payload=split(nested_payload,",")

Re: I need to put 4 field in table view but some field have long sentence so the table view was in organize.

karu0711 — Tue, 29 Nov 2022 18:42:52 GMT

but when I use "," it spliting the my value where "," appeared.

in my value I have commas I don't want to split by commas. I want to split by different field only.

Re: I need to put 4 field in table view but some field have long sentence so the table view was in organize.

karu0711 — Tue, 29 Nov 2022 18:52:02 GMT

Re: I need to put 4 field in table view but some field have long sentence so the table view was in organize.

ITWhisperer — Tue, 29 Nov 2022 18:52:20 GMT

Use a delimiter that doesn't appear in your fields, for example:

| eval nested_payload=mvzip(mvzip(flaw, solution,"#"),answer,"#") | eval nested_payload=split(nested_payload,"#")

Re: I need to put 4 field in table view but some field have long sentence so the table view was in organize.

karu0711 — Tue, 29 Nov 2022 18:54:11 GMT

when I use above SPL I get field separately but my flaw and answer field value are repeating. on the first value relating for all.

Re: I need to put 4 field in table view but some field have long sentence so the table view was in organize.

ITWhisperer — Tue, 29 Nov 2022 19:35:50 GMT

Please can you share an anonymised sample of the log you are trying to extract from?

Re: I need to put 4 field in table view but some field have long sentence so the table view was in organize.

karu0711 — Tue, 29 Nov 2022 19:40:51 GMT

Found 2 issues of Low severity. CWE-209: Information Exposure Through an Error Message: tiles/error/errorUncaughtMessage.jsp:9 Details: The application calls the javax.servlet.jsp.JspWriter.print() function, which may expose information about the application logic or other details such as the names and versions of the application container and associated components. This information can be useful in executing other attacks and can also enable the attacker to target known vulnerabilities in application components. Ensure that error codes or other messages returned to end users are not overly verbose. Sanitize all messages of any sensitive information that is not absolutely necessary. References: <a href="https://cwe.mitre.org/data/definitions/209.html">CWE</a> https://downloads.veracode.com/securityscan/cwe/v4/java/209.html CWE-245: J2EE Bad Practices: Direct Management of Connections: edu/ufl/osg/webmail/prefs/DBPrefsPlugIn.java:172 Details: This call to getConnection() fails to use the J2EE container's resource management facilities as required by the J2EE standard. Request the connection from the container rather than attempting to access it directly. References: <a href="https://cwe.mitre. org/data/definitions/245.html">CWE</a> https://downloads.veracode.com/securityscan/cwe/v4/java/245.html

Found 2 issues of Low severity.
CWE-209: Information Exposure Through an Error Message: tiles/error/errorUncaughtMessage.jsp:9
Details: <span> The application calls the javax.servlet.jsp.JspWriter.print() function, which may expose information about the application logic or other 
details such as the names and versions of the application container and associated components.  This information can be useful in executing other attacks 
and can also enable the attacker to target known vulnerabilities in application components. </span> <span>Ensure that error codes or other messages 
returned to end users are not overly verbose.  Sanitize all messages of any sensitive information that is not absolutely necessary.</span> 
<span>References: <a href="https://cwe.mitre.org/data/definitions/209.html">CWE</a></span>
https://downloads.veracode.com/securityscan/cwe/v4/java/209.html
CWE-245: J2EE Bad Practices: Direct Management of Connections: edu/ufl/osg/webmail/prefs/DBPrefsPlugIn.java:172
Details: <span>This call to getConnection() fails to use the J2EE container's resource management facilities as required by the J2EE standard.</span> 
<span>Request the connection from the container rather than attempting to access it directly.</span> <span>References: <a href="https://cwe.mitre.
org/data/definitions/245.html">CWE</a></span>
https://downloads.veracode.com/securityscan/cwe/v4/java/245.html

Re: I need to put 4 field in table view but some field have long sentence so the table view was in organize.

ITWhisperer — Wed, 30 Nov 2022 08:39:21 GMT

It is not clear from this which field is flaw, solution and answer. Please can you show the results of

| table flaw solution answer

for these events?

Re: I need to put 4 field in table view but some field have long sentence so the table view was in organize.

karu0711 — Wed, 30 Nov 2022 14:26:38 GMT

Flaw field

The application calls the javax.servlet.jsp.JspWriter.print() function, which may expose information about the application logic or other 
details such as the names and versions of the application container and associated components.  This information can be useful in executing other attacks 
and can also enable the attacker to target known vulnerabilities in application components.

Solution field

Ensure that error codes or other messages 
returned to end users are not overly verbose.  Sanitize all messages of any sensitive information that is not absolutely necessary

Answer field

https://cwe.mitre.org/data/definitions/209.html

Re: I need to put 4 field in table view but some field have long sentence so the table view was in organize.

ITWhisperer — Wed, 30 Nov 2022 14:32:44 GMT

So, none of this text includes a hash (#) so use that as your delimiter on the mvzip and split commands (as I suggested earlier)

Re: I need to put 4 field in table view but some field have long sentence so the table view was in organize.

karu0711 — Wed, 30 Nov 2022 15:09:07 GMT

It still putting the field together. But when I use the Below SPL it is separating the fields as I want but first two felids are repeating first event field value. Why is this happening?

index=main sourcetype="ms.356"
| eval nested_payload=mvzip(flaw, solution, "--")
| mvexpand nested_payload
| eval flaw=mvindex(split(nested_payload,"--"),1)
| eval solution=mvindex(split(nested_payload,"--"),0)
| eval nested_payload=mvzip(answer, COE, "--")
| mvexpand nested_payload
| eval answer=mvindex(split(nested_payload,"--"),1)
| eval COE=mvindex(split(nested_payload,"--"),0)
| table flaw solution answer COE

Re: I need to put 4 field in table view but some field have long sentence so the table view was in organize.

ITWhisperer — Wed, 30 Nov 2022 15:41:54 GMT

Because that's how mvexpand works - it duplicates all the fields not being expanded.

Re: I need to put 4 field in table view but some field have long sentence so the table view was in organize.

karu0711 — Wed, 30 Nov 2022 16:11:42 GMT

I am trying to accomplish here is getting all the event value in same row. when I you the table command ther is no row separation each event. Is there any way I can accomplish without using mvzip or mvexpand. and field also need to be searchable form dashboard.

Re: I need to put 4 field in table view but some field have long sentence so the table view was in organize.

ITWhisperer — Wed, 30 Nov 2022 16:58:26 GMT

Something like this?

| eval joined=mvappend(flaw,solution,answer) | eval joined=mvjoin(joined," ")

Re: I need to put 4 field in table view but some field have long sentence so the table view was in organize.

karu0711 — Wed, 30 Nov 2022 17:01:25 GMT

which query I use this?

Re: I need to put 4 field in table view but some field have long sentence so the table view was in organize.

ITWhisperer — Wed, 30 Nov 2022 17:04:30 GMT

index=main sourcetype="ms.356" | eval joined=mvappend(flaw,solution,answer,COE) | eval joined=mvjoin(joined," ")