Splunk Search

How to create a new field using rex?

Rithekakan
Path Finder

Hi Spelunker, I want to create a field "Credentialed checks:" with this field value. Please help.

regards,

Nessus version : 8.10.0
Nessus build : 20232
Plugin feed version : 202210171349
Scanner edition used : Nessus
Scanner OS : LINUX
Scanner distribution : es6-x86-64
Scan type : Normal
Scan policy used : eb1cd575-c2d4-5be5-8010-1290128ec92e-23586099/01. PCI-INTERNAL-VA-SCAN
Scanner IP : 10.6.6.51
Port scanner(s) : nessus_syn_scanner
Port range : sc-default
Ping RTT : Unavailable
Thorough tests : no
Experimental tests : no
Plugin debugging enabled : no
Paranoia level : 1
Report verbosity : 1
Safe checks : yes
Optimize the test : yes
Credentialed checks : no
Patch management checks : None
Display superseded patches : no (supersedence plugin launched)
CGI scanning : disabled
Web application tests : disabled
Max hosts : 30
Max checks : 4
Recv timeout : 5
Backports : Detected
Allow post-scan editing : Yes
Scan Start Date : 2022/10/18 19:50 +07
Scan duration : 561 sec"

........................................................................................................

Nessus version : 8.10.0
Nessus build : 20232
Plugin feed version : 202210171349
Scanner edition used : Nessus
Scanner OS : LINUX
Scanner distribution : es6-x86-64
Scan type : Normal
Scan policy used : eb1cd575-c2d4-5be5-8010-1290128ec92e-23586099/01. PCI-INTERNAL-VA-SCAN
Scanner IP : 10.6.6.51
Port scanner(s) : netstat
Port range : sc-default
Ping RTT : Unavailable
Thorough tests : no
Experimental tests : no
Plugin debugging enabled : no
Paranoia level : 1
Report verbosity : 1
Safe checks : yes
Optimize the test : yes
Credentialed checks : yes, as 'isdscan' via ssh
Attempt Least Privilege : no
Patch management checks : None
Display superseded patches : no (supersedence plugin launched)
CGI scanning : disabled
Web application tests : disabled
Max hosts : 30
Max checks : 4
Recv timeout : 5
Backports : Detected
Allow post-scan editing : Yes
Scan Start Date : 2022/10/18 19:51 +07
Scan duration : 2483 sec"

Labels (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

It would help to know what you've tried so far.  Did it include something like this?

 

| rex "Credentialed checks : (?<Credentialed_checks>.*?)"

 

---
If this reply helps you, Karma would be appreciated.
0 Karma

Rithekakan
Path Finder

Hi richgalloway,  I've update something in your regex and it work now. I appreciate you!

 

| rex "Credentialed checks : (?<Credentialed_checks>..*)"

Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...