Archive

NESSUS Scan digest

Motivator

I am doing a monitor file input of a nessas scan data files.
Splunk reads the files in as one event per line.

The report on each system scaned is between the following to tags in the data file

<ReportHost name="xxx.xxx.xxx.xxx">
</ReportHost>

there can be as many as 3 or 4 hundred lines between these tags

I have two questions

1) What is the best way to put the data into splunk so that all the "ReportHost" info is together for searching reporting on each system?
2) how do I get the multi event information already in the splunk index together into one event for each ReportHost so that I can use the existing data to develop reports?

Tags (1)
0 Karma
1 Solution

Splunk Employee
Splunk Employee

You have to possibilities :

  • define the event parsing at index time : event breaking

http://docs.splunk.com/Documentation/Splunk/4.2.5/Data/Indexmulti-lineevents

in props.conf of the indexer

[mynessussourcetype]
SHOULD_LINEMERGE=true
BREAK_ONLY_BEFORE =<ReportHost name=
MUST_BREAK_AFTER =</ReportHost>

(the < and > may be missing before.)

and define the timestamp extaction
see http://docs.splunk.com/Documentation/Splunk/4.2.5/Data/Tunetimestampextractionforbetterindexingperfo...

  • or if all your events are indexed as single line events, try to use transactions at search time

see http://docs.splunk.com/Documentation/Splunk/4.2.5/SearchReference/Transaction

sourcetype=mynessussourcetype | transaction startswith="<ReportHost name" endswith="</ReportHost>"

and tune using all the other options (maxspan, maxpause ...)

View solution in original post

Splunk Employee
Splunk Employee

You have to possibilities :

  • define the event parsing at index time : event breaking

http://docs.splunk.com/Documentation/Splunk/4.2.5/Data/Indexmulti-lineevents

in props.conf of the indexer

[mynessussourcetype]
SHOULD_LINEMERGE=true
BREAK_ONLY_BEFORE =<ReportHost name=
MUST_BREAK_AFTER =</ReportHost>

(the < and > may be missing before.)

and define the timestamp extaction
see http://docs.splunk.com/Documentation/Splunk/4.2.5/Data/Tunetimestampextractionforbetterindexingperfo...

  • or if all your events are indexed as single line events, try to use transactions at search time

see http://docs.splunk.com/Documentation/Splunk/4.2.5/SearchReference/Transaction

sourcetype=mynessussourcetype | transaction startswith="<ReportHost name" endswith="</ReportHost>"

and tune using all the other options (maxspan, maxpause ...)

View solution in original post

Motivator

Thats it thanks this works

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!