Getting Data In

How to split multiple lines in a table into separate rows?

jimmynguy
Explorer

I have some data from Tenable and I am trying to weed out the rows with multiple values into its own row.

alt text

A good example would be is the 4th row with 3 CVE-IDs (CVE-2003-1567, CVE-2004-2320, and CVE-2010-0386).

Instead, I would like to break it out to look like this:

CVE-2003-1567 Disable these methods. Refer to the plugin output for more information.
CVE-2004-2320 Disable these methods. Refer to the plugin output for more information.
CVE-2010-0386 Disable these methods. Refer to the plugin output for more information.

Any ideas?

Thanks

Tags (2)
0 Karma
1 Solution

FrankVl
Ultra Champion

Sounds like a case for the mvexpand command: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Mvexpand

Try:

...your base search that results in this data...
| mvexpand "CVE ID"

View solution in original post

FrankVl
Ultra Champion

Sounds like a case for the mvexpand command: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Mvexpand

Try:

...your base search that results in this data...
| mvexpand "CVE ID"

jimmynguy
Explorer

Frank,

index=tenable_data severity!="informational" hasBeenMitigated=0 
| fields cve, solution
| dedup cve
| mvexpand cve
| rename cve as "CVE ID", solution as "Solution"
| table "CVE ID","Solution"
| sort "CVE ID"

It would have been more useful if I sent you guys my SPL, sorry for not doing that! But, | mvexpand "CVE-ID" would not work, I had to use | mvexpand cve. Could you explain why that is the case? Does | mvexpand not work if a field has been renamed?

Thanks for introducing me to the mvexpand command!!

0 Karma

FrankVl
Ultra Champion

If you put the mvexpand command before the rename command, then of course you need to use the original name of the field 🙂

0 Karma

jimmynguy
Explorer

I swear it didn't work after the rename command.. must have overlooked it or my brain was still asleep.. Anyways, thank you so much for the help! 🙂

Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...