Splunk Search

How to create a new field using rex?

Rithekakan
Path Finder

Hi Spelunker, I want to create a field "Credentialed checks:" with this field value. Please help.

regards,

Nessus version : 8.10.0
Nessus build : 20232
Plugin feed version : 202210171349
Scanner edition used : Nessus
Scanner OS : LINUX
Scanner distribution : es6-x86-64
Scan type : Normal
Scan policy used : eb1cd575-c2d4-5be5-8010-1290128ec92e-23586099/01. PCI-INTERNAL-VA-SCAN
Scanner IP : 10.6.6.51
Port scanner(s) : nessus_syn_scanner
Port range : sc-default
Ping RTT : Unavailable
Thorough tests : no
Experimental tests : no
Plugin debugging enabled : no
Paranoia level : 1
Report verbosity : 1
Safe checks : yes
Optimize the test : yes
Credentialed checks : no
Patch management checks : None
Display superseded patches : no (supersedence plugin launched)
CGI scanning : disabled
Web application tests : disabled
Max hosts : 30
Max checks : 4
Recv timeout : 5
Backports : Detected
Allow post-scan editing : Yes
Scan Start Date : 2022/10/18 19:50 +07
Scan duration : 561 sec"

........................................................................................................

Nessus version : 8.10.0
Nessus build : 20232
Plugin feed version : 202210171349
Scanner edition used : Nessus
Scanner OS : LINUX
Scanner distribution : es6-x86-64
Scan type : Normal
Scan policy used : eb1cd575-c2d4-5be5-8010-1290128ec92e-23586099/01. PCI-INTERNAL-VA-SCAN
Scanner IP : 10.6.6.51
Port scanner(s) : netstat
Port range : sc-default
Ping RTT : Unavailable
Thorough tests : no
Experimental tests : no
Plugin debugging enabled : no
Paranoia level : 1
Report verbosity : 1
Safe checks : yes
Optimize the test : yes
Credentialed checks : yes, as 'isdscan' via ssh
Attempt Least Privilege : no
Patch management checks : None
Display superseded patches : no (supersedence plugin launched)
CGI scanning : disabled
Web application tests : disabled
Max hosts : 30
Max checks : 4
Recv timeout : 5
Backports : Detected
Allow post-scan editing : Yes
Scan Start Date : 2022/10/18 19:51 +07
Scan duration : 2483 sec"

Labels (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

It would help to know what you've tried so far.  Did it include something like this?

 

| rex "Credentialed checks : (?<Credentialed_checks>.*?)"

 

---
If this reply helps you, Karma would be appreciated.
0 Karma

Rithekakan
Path Finder

Hi richgalloway,  I've update something in your regex and it work now. I appreciate you!

 

| rex "Credentialed checks : (?<Credentialed_checks>..*)"

Get Updates on the Splunk Community!

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...

Splunk APM: New Product Features + Community Office Hours Recap!

Howdy Splunk Community! Over the past few months, we’ve had a lot going on in the world of Splunk Application ...

Index This | Forward, I’m heavy; backward, I’m not. What am I?

April 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...