https://community.splunk.com/t5/Splunk-Search/How-do-I-extract-this-Operating-System-field-from-my-sample-data/m-p/212688#M62317 <P>I have exported a CSV from Nessus and I want to extract "Remote operating system : " and want the result as <CODE>Microsoft Windows Server 2008 R2 Datacenter Service Pack 1</CODE> and <CODE>Juniper Junos Version 12.3R7.7</CODE></P> <P>Any suggestions?</P> <P>Sample Data:</P> <PRE><CODE>"11936","","","None","192.168.1.4","tcp","0","OS Identification","It is possible to guess the remote operating system.","Using a combination of remote probes (e.g. TCP/IP, SMB, HTTP, NTP, SNMP, etc.), it is possible to guess the name of the remote operating system in use. It is also sometimes possible to guess the version of the operating system.","n/a",""," Remote operating system : Microsoft Windows Server 2008 R2 Datacenter Service Pack 1 Confidence level : 99 "11936","","","None","192.168.1.7","tcp","0","OS Identification","It is possible to guess the remote operating system.","Using a combination of remote probes (e.g. TCP/IP, SMB, HTTP, NTP, SNMP, etc.), it is possible to guess the name of the remote operating system in use. It is also sometimes possible to guess the version of the operating system.","n/a",""," Remote operating system : Juniper Junos Version 12.3R7.7 </CODE></PRE> Wed, 04 Nov 2015 04:35:54 GMT sumansah 2015-11-04T04:35:54Z https://community.splunk.com/t5/Splunk-Search/How-do-I-extract-this-Operating-System-field-from-my-sample-data/m-p/212688#M62317 <P>I have exported a CSV from Nessus and I want to extract "Remote operating system : " and want the result as <CODE>Microsoft Windows Server 2008 R2 Datacenter Service Pack 1</CODE> and <CODE>Juniper Junos Version 12.3R7.7</CODE></P> <P>Any suggestions?</P> <P>Sample Data:</P> <PRE><CODE>"11936","","","None","192.168.1.4","tcp","0","OS Identification","It is possible to guess the remote operating system.","Using a combination of remote probes (e.g. TCP/IP, SMB, HTTP, NTP, SNMP, etc.), it is possible to guess the name of the remote operating system in use. It is also sometimes possible to guess the version of the operating system.","n/a",""," Remote operating system : Microsoft Windows Server 2008 R2 Datacenter Service Pack 1 Confidence level : 99 "11936","","","None","192.168.1.7","tcp","0","OS Identification","It is possible to guess the remote operating system.","Using a combination of remote probes (e.g. TCP/IP, SMB, HTTP, NTP, SNMP, etc.), it is possible to guess the name of the remote operating system in use. It is also sometimes possible to guess the version of the operating system.","n/a",""," Remote operating system : Juniper Junos Version 12.3R7.7 </CODE></PRE> Wed, 04 Nov 2015 04:35:54 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-extract-this-Operating-System-field-from-my-sample-data/m-p/212688#M62317 sumansah 2015-11-04T04:35:54Z https://community.splunk.com/t5/Splunk-Search/How-do-I-extract-this-Operating-System-field-from-my-sample-data/m-p/212689#M62318 <P>It sounds like you want to do a field extraction:</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.3.0/Knowledge/ExtractfieldsinteractivelywithIFX">http://docs.splunk.com/Documentation/Splunk/6.3.0/Knowledge/ExtractfieldsinteractivelywithIFX</A></P> <P>If the two examples above are from your search results, you should be able to do the following:</P> <P>Expand one of the search results</P> <P>Click Event Actions -- Extract Field</P> <P>Click Regular Expressions -- Click Next</P> <P>Select the value for the operating system (ex: Microsoft Windows Server 2008 R2 Datacenter Service Pack 1). Select just the value, not the "Remote operating system" label</P> <P>Enter a name for the field (ex: remote_os) and click Add Extraction</P> <P>Click Next a couple more times and click Save.</P> <P>When you do a search on that data again, you should see remote_os show up as an interesting field.</P> Wed, 04 Nov 2015 18:23:10 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-extract-this-Operating-System-field-from-my-sample-data/m-p/212689#M62318 kbarker302 2015-11-04T18:23:10Z