Splunk Search

How can i split this field into multiple columns?

marceldera
Explorer

Filed name = pluginText

<plugin_output>Information about this scan :

Nessus version : 10.3.0

Nessus build : 20080

Plugin feed version : 202208222232

Scanner edition used : Nessus

Scanner OS : LINUX

Scanner distribution : es7-x86-64

Scan type : Normal

Scan name : Host_Discovery & OS_Identification

Scan policy used : 93e1da98-656c-5cd5-933b-ce6665fc0486-1939724/Host_Discovery_Scan_03292022 Scanner IP : 10.102.10.1

Port scanner(s) : nessus_syn_scanner

Port range : sc-default

Ping RTT : 11.921 ms

Thorough tests : no

Experimental tests : no

Plugin debugging enabled : no

Paranoia level : 1

Report verbosity : 1

Safe checks : yes

Optimize the test : yes

Credentialed checks : no

Patch management checks : None

Display superseded patches : yes (supersedence plugin launched)

CGI scanning : disabled

Web application tests : disabled

Max hosts : 30

Max checks : 5

Recv timeout : 5

Backports : None

Allow post-scan editing : Yes

Scan Start Date : 2021/8/10 1:55 UTC

can duration : 63 sec

</plugin_output>

Labels (3)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| rex field=pluginText max_match=0 "\s*(?<namevalue>[^:]+ : .+)"
| streamstats count as _row 
| mvexpand namevalue
| rex field=namevalue "(?<name>[^:]+) : (?<value>.+)"
| eval {name}=value
| fields - name value namevalue
| stats values(*) as * by _row

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| rex field=pluginText max_match=0 "\s*(?<namevalue>[^:]+ : .+)"
| streamstats count as _row 
| mvexpand namevalue
| rex field=namevalue "(?<name>[^:]+) : (?<value>.+)"
| eval {name}=value
| fields - name value namevalue
| stats values(*) as * by _row
0 Karma

marceldera
Explorer

Thank you so much, I really appreciate it.  It works perfectly.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Splunk App Dev Quarterly Roundup: AI, Agents, and Innovation!

Another quarter, another wave of innovation. From complex integrations to pushing the limits ...

What’s New in Splunk AI: Volume 02

Welcome to the second edition of “What’s New in Splunk AI” where we look at the latest and greatest updates, ...

Value Insights: Now Generally Available in the CMC

Organizations are under pressure to move faster, control cost, expand AI adoption, and prove value with more ...