Splunk Search

How can i split this field into multiple columns?

marceldera
Explorer

Filed name = pluginText

<plugin_output>Information about this scan :

Nessus version : 10.3.0

Nessus build : 20080

Plugin feed version : 202208222232

Scanner edition used : Nessus

Scanner OS : LINUX

Scanner distribution : es7-x86-64

Scan type : Normal

Scan name : Host_Discovery & OS_Identification

Scan policy used : 93e1da98-656c-5cd5-933b-ce6665fc0486-1939724/Host_Discovery_Scan_03292022 Scanner IP : 10.102.10.1

Port scanner(s) : nessus_syn_scanner

Port range : sc-default

Ping RTT : 11.921 ms

Thorough tests : no

Experimental tests : no

Plugin debugging enabled : no

Paranoia level : 1

Report verbosity : 1

Safe checks : yes

Optimize the test : yes

Credentialed checks : no

Patch management checks : None

Display superseded patches : yes (supersedence plugin launched)

CGI scanning : disabled

Web application tests : disabled

Max hosts : 30

Max checks : 5

Recv timeout : 5

Backports : None

Allow post-scan editing : Yes

Scan Start Date : 2021/8/10 1:55 UTC

can duration : 63 sec

</plugin_output>

Labels (3)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| rex field=pluginText max_match=0 "\s*(?<namevalue>[^:]+ : .+)"
| streamstats count as _row 
| mvexpand namevalue
| rex field=namevalue "(?<name>[^:]+) : (?<value>.+)"
| eval {name}=value
| fields - name value namevalue
| stats values(*) as * by _row

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| rex field=pluginText max_match=0 "\s*(?<namevalue>[^:]+ : .+)"
| streamstats count as _row 
| mvexpand namevalue
| rex field=namevalue "(?<name>[^:]+) : (?<value>.+)"
| eval {name}=value
| fields - name value namevalue
| stats values(*) as * by _row
0 Karma

marceldera
Explorer

Thank you so much, I really appreciate it.  It works perfectly.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Index This | What travels the world but is also stuck in place?

April 2026 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Discover New Use Cases: Unlock Greater Value from Your Existing Splunk Data

Realizing the full potential of your Splunk investment requires more than just understanding current usage; it ...

Continue Your Journey: Join Session 2 of the Data Management and Federation Bootcamp ...

As data volumes continue to grow and environments become more distributed, managing and optimizing data ...