NESSUS Scan digest

[hartfoml]

I am doing a monitor file input of a nessas scan data files.
Splunk reads the files in as one event per line.

The report on each system scaned is between the following to tags in the data file

<ReportHost name="xxx.xxx.xxx.xxx">
</ReportHost>

there can be as many as 3 or 4 hundred lines between these tags

I have two questions

1) What is the best way to put the data into splunk so that all the "ReportHost" info is together for searching reporting on each system?
2) how do I get the multi event information already in the splunk index together into one event for each ReportHost so that I can use the existing data to develop reports?

[yannK · Accepted solution]

You have to possibilities :

• define the event parsing at index time : event breaking

http://docs.splunk.com/Documentation/Splunk/4.2.5/Data/Indexmulti-lineevents

in props.conf of the indexer

[mynessussourcetype]
SHOULD_LINEMERGE=true
BREAK_ONLY_BEFORE =<ReportHost name=
MUST_BREAK_AFTER =</ReportHost>

(the < and > may be missing before.)

and define the timestamp extaction
see http://docs.splunk.com/Documentation/Splunk/4.2.5/Data/Tunetimestampextractionforbetterindexingperfo...

• or if all your events are indexed as single line events, try to use transactions at search time

see http://docs.splunk.com/Documentation/Splunk/4.2.5/SearchReference/Transaction

sourcetype=mynessussourcetype | transaction startswith="<ReportHost name" endswith="</ReportHost>"

and tune using all the other options (maxspan, maxpause ...)

[hartfoml]

Thats it thanks this works