Splunk Search

How can i split this field into multiple columns?

marceldera
Explorer

Filed name = pluginText

<plugin_output>Information about this scan :

Nessus version : 10.3.0

Nessus build : 20080

Plugin feed version : 202208222232

Scanner edition used : Nessus

Scanner OS : LINUX

Scanner distribution : es7-x86-64

Scan type : Normal

Scan name : Host_Discovery & OS_Identification

Scan policy used : 93e1da98-656c-5cd5-933b-ce6665fc0486-1939724/Host_Discovery_Scan_03292022 Scanner IP : 10.102.10.1

Port scanner(s) : nessus_syn_scanner

Port range : sc-default

Ping RTT : 11.921 ms

Thorough tests : no

Experimental tests : no

Plugin debugging enabled : no

Paranoia level : 1

Report verbosity : 1

Safe checks : yes

Optimize the test : yes

Credentialed checks : no

Patch management checks : None

Display superseded patches : yes (supersedence plugin launched)

CGI scanning : disabled

Web application tests : disabled

Max hosts : 30

Max checks : 5

Recv timeout : 5

Backports : None

Allow post-scan editing : Yes

Scan Start Date : 2021/8/10 1:55 UTC

can duration : 63 sec

</plugin_output>

Labels (3)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| rex field=pluginText max_match=0 "\s*(?<namevalue>[^:]+ : .+)"
| streamstats count as _row 
| mvexpand namevalue
| rex field=namevalue "(?<name>[^:]+) : (?<value>.+)"
| eval {name}=value
| fields - name value namevalue
| stats values(*) as * by _row

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| rex field=pluginText max_match=0 "\s*(?<namevalue>[^:]+ : .+)"
| streamstats count as _row 
| mvexpand namevalue
| rex field=namevalue "(?<name>[^:]+) : (?<value>.+)"
| eval {name}=value
| fields - name value namevalue
| stats values(*) as * by _row
0 Karma

marceldera
Explorer

Thank you so much, I really appreciate it.  It works perfectly.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...