Splunk Search

How to create a new field using rex?

Rithekakan
Path Finder

Hi Spelunker, I want to create a field "Credentialed checks:" with this field value. Please help.

regards,

Nessus version : 8.10.0
Nessus build : 20232
Plugin feed version : 202210171349
Scanner edition used : Nessus
Scanner OS : LINUX
Scanner distribution : es6-x86-64
Scan type : Normal
Scan policy used : eb1cd575-c2d4-5be5-8010-1290128ec92e-23586099/01. PCI-INTERNAL-VA-SCAN
Scanner IP : 10.6.6.51
Port scanner(s) : nessus_syn_scanner
Port range : sc-default
Ping RTT : Unavailable
Thorough tests : no
Experimental tests : no
Plugin debugging enabled : no
Paranoia level : 1
Report verbosity : 1
Safe checks : yes
Optimize the test : yes
Credentialed checks : no
Patch management checks : None
Display superseded patches : no (supersedence plugin launched)
CGI scanning : disabled
Web application tests : disabled
Max hosts : 30
Max checks : 4
Recv timeout : 5
Backports : Detected
Allow post-scan editing : Yes
Scan Start Date : 2022/10/18 19:50 +07
Scan duration : 561 sec"

........................................................................................................

Nessus version : 8.10.0
Nessus build : 20232
Plugin feed version : 202210171349
Scanner edition used : Nessus
Scanner OS : LINUX
Scanner distribution : es6-x86-64
Scan type : Normal
Scan policy used : eb1cd575-c2d4-5be5-8010-1290128ec92e-23586099/01. PCI-INTERNAL-VA-SCAN
Scanner IP : 10.6.6.51
Port scanner(s) : netstat
Port range : sc-default
Ping RTT : Unavailable
Thorough tests : no
Experimental tests : no
Plugin debugging enabled : no
Paranoia level : 1
Report verbosity : 1
Safe checks : yes
Optimize the test : yes
Credentialed checks : yes, as 'isdscan' via ssh
Attempt Least Privilege : no
Patch management checks : None
Display superseded patches : no (supersedence plugin launched)
CGI scanning : disabled
Web application tests : disabled
Max hosts : 30
Max checks : 4
Recv timeout : 5
Backports : Detected
Allow post-scan editing : Yes
Scan Start Date : 2022/10/18 19:51 +07
Scan duration : 2483 sec"

Labels (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

It would help to know what you've tried so far.  Did it include something like this?

 

| rex "Credentialed checks : (?<Credentialed_checks>.*?)"

 

---
If this reply helps you, Karma would be appreciated.
0 Karma

Rithekakan
Path Finder

Hi richgalloway,  I've update something in your regex and it work now. I appreciate you!

 

| rex "Credentialed checks : (?<Credentialed_checks>..*)"

Get Updates on the Splunk Community!

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...

Splunk Answers Content Calendar, June Edition II

Get ready to dive into Splunk Dashboard panels this week! We'll be tackling common questions around ...

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...