https://community.splunk.com/t5/Splunk-Search/How-to-search-for-critical-nessus-findings-and-correlate/m-p/233939#M69528 <P>Try this</P> <PRE><CODE>(sourcetype=nessus:scan plugin_id=* severity=critical "host-ip"=*) OR (sourcetype=nessus:plugin id=*) | fields host-ip, host_end, solution, description &lt;&lt;including all relevant fields&gt;&gt; | stats values(*) as * by plugin_id </CODE></PRE> Mon, 21 Nov 2016 14:16:51 GMT sundareshr 2016-11-21T14:16:51Z https://community.splunk.com/t5/Splunk-Search/How-to-search-for-critical-nessus-findings-and-correlate/m-p/233938#M69527 <P>I have my nessus data in splunk, and in my example below I would like to search for all critical findings, and for each of those I would like to correlate the finding with the plugin data and present the details and remediation. The search does not work, and I would like some help if I'm doing this correctly (I'm a complete newbie with the foreach-command).</P> <PRE><CODE>sourcetype=nessus:scan plugin_id=* severity=critical "host-ip"=* | foreach "host-ip" [search (sourcetype=nessus:scan plugin_id=* severity=critical "host-ip"=&lt;&lt;FIELD&gt;&gt;) OR (sourcetype=nessus:plugin id=*)] | eval match_id=coalesce(id,plugin_id) | stats values(*) AS * by match_id | search plugin_id=* id=* | table host-ip,host_end,match_id,solution,description </CODE></PRE> Mon, 21 Nov 2016 09:33:46 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-for-critical-nessus-findings-and-correlate/m-p/233938#M69527 jesperp 2016-11-21T09:33:46Z https://community.splunk.com/t5/Splunk-Search/How-to-search-for-critical-nessus-findings-and-correlate/m-p/233939#M69528 <P>Try this</P> <PRE><CODE>(sourcetype=nessus:scan plugin_id=* severity=critical "host-ip"=*) OR (sourcetype=nessus:plugin id=*) | fields host-ip, host_end, solution, description &lt;&lt;including all relevant fields&gt;&gt; | stats values(*) as * by plugin_id </CODE></PRE> Mon, 21 Nov 2016 14:16:51 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-for-critical-nessus-findings-and-correlate/m-p/233939#M69528 sundareshr 2016-11-21T14:16:51Z