Splunk Search

How to create a new field using rex?

Rithekakan
Path Finder

Hi Spelunker, I want to create a field "Credentialed checks:" with this field value. Please help.

regards,

Nessus version : 8.10.0
Nessus build : 20232
Plugin feed version : 202210171349
Scanner edition used : Nessus
Scanner OS : LINUX
Scanner distribution : es6-x86-64
Scan type : Normal
Scan policy used : eb1cd575-c2d4-5be5-8010-1290128ec92e-23586099/01. PCI-INTERNAL-VA-SCAN
Scanner IP : 10.6.6.51
Port scanner(s) : nessus_syn_scanner
Port range : sc-default
Ping RTT : Unavailable
Thorough tests : no
Experimental tests : no
Plugin debugging enabled : no
Paranoia level : 1
Report verbosity : 1
Safe checks : yes
Optimize the test : yes
Credentialed checks : no
Patch management checks : None
Display superseded patches : no (supersedence plugin launched)
CGI scanning : disabled
Web application tests : disabled
Max hosts : 30
Max checks : 4
Recv timeout : 5
Backports : Detected
Allow post-scan editing : Yes
Scan Start Date : 2022/10/18 19:50 +07
Scan duration : 561 sec"

........................................................................................................

Nessus version : 8.10.0
Nessus build : 20232
Plugin feed version : 202210171349
Scanner edition used : Nessus
Scanner OS : LINUX
Scanner distribution : es6-x86-64
Scan type : Normal
Scan policy used : eb1cd575-c2d4-5be5-8010-1290128ec92e-23586099/01. PCI-INTERNAL-VA-SCAN
Scanner IP : 10.6.6.51
Port scanner(s) : netstat
Port range : sc-default
Ping RTT : Unavailable
Thorough tests : no
Experimental tests : no
Plugin debugging enabled : no
Paranoia level : 1
Report verbosity : 1
Safe checks : yes
Optimize the test : yes
Credentialed checks : yes, as 'isdscan' via ssh
Attempt Least Privilege : no
Patch management checks : None
Display superseded patches : no (supersedence plugin launched)
CGI scanning : disabled
Web application tests : disabled
Max hosts : 30
Max checks : 4
Recv timeout : 5
Backports : Detected
Allow post-scan editing : Yes
Scan Start Date : 2022/10/18 19:51 +07
Scan duration : 2483 sec"

Labels (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

It would help to know what you've tried so far.  Did it include something like this?

 

| rex "Credentialed checks : (?<Credentialed_checks>.*?)"

 

---
If this reply helps you, Karma would be appreciated.
0 Karma

Rithekakan
Path Finder

Hi richgalloway,  I've update something in your regex and it work now. I appreciate you!

 

| rex "Credentialed checks : (?<Credentialed_checks>..*)"

Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...