Splunk Search

How to create a new field using rex?

Rithekakan
Path Finder

Hi Spelunker, I want to create a field "Credentialed checks:" with this field value. Please help.

regards,

Nessus version : 8.10.0
Nessus build : 20232
Plugin feed version : 202210171349
Scanner edition used : Nessus
Scanner OS : LINUX
Scanner distribution : es6-x86-64
Scan type : Normal
Scan policy used : eb1cd575-c2d4-5be5-8010-1290128ec92e-23586099/01. PCI-INTERNAL-VA-SCAN
Scanner IP : 10.6.6.51
Port scanner(s) : nessus_syn_scanner
Port range : sc-default
Ping RTT : Unavailable
Thorough tests : no
Experimental tests : no
Plugin debugging enabled : no
Paranoia level : 1
Report verbosity : 1
Safe checks : yes
Optimize the test : yes
Credentialed checks : no
Patch management checks : None
Display superseded patches : no (supersedence plugin launched)
CGI scanning : disabled
Web application tests : disabled
Max hosts : 30
Max checks : 4
Recv timeout : 5
Backports : Detected
Allow post-scan editing : Yes
Scan Start Date : 2022/10/18 19:50 +07
Scan duration : 561 sec"

........................................................................................................

Nessus version : 8.10.0
Nessus build : 20232
Plugin feed version : 202210171349
Scanner edition used : Nessus
Scanner OS : LINUX
Scanner distribution : es6-x86-64
Scan type : Normal
Scan policy used : eb1cd575-c2d4-5be5-8010-1290128ec92e-23586099/01. PCI-INTERNAL-VA-SCAN
Scanner IP : 10.6.6.51
Port scanner(s) : netstat
Port range : sc-default
Ping RTT : Unavailable
Thorough tests : no
Experimental tests : no
Plugin debugging enabled : no
Paranoia level : 1
Report verbosity : 1
Safe checks : yes
Optimize the test : yes
Credentialed checks : yes, as 'isdscan' via ssh
Attempt Least Privilege : no
Patch management checks : None
Display superseded patches : no (supersedence plugin launched)
CGI scanning : disabled
Web application tests : disabled
Max hosts : 30
Max checks : 4
Recv timeout : 5
Backports : Detected
Allow post-scan editing : Yes
Scan Start Date : 2022/10/18 19:51 +07
Scan duration : 2483 sec"

Labels (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

It would help to know what you've tried so far.  Did it include something like this?

 

| rex "Credentialed checks : (?<Credentialed_checks>.*?)"

 

---
If this reply helps you, Karma would be appreciated.
0 Karma

Rithekakan
Path Finder

Hi richgalloway,  I've update something in your regex and it work now. I appreciate you!

 

| rex "Credentialed checks : (?<Credentialed_checks>..*)"

Get Updates on the Splunk Community!

Good Sourcetype Naming

When it comes to getting data in, one of the earliest decisions made is what to use as a sourcetype. Often, ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Splunk App for Anomaly Detection End of Life Announcement

Q: What is happening to the Splunk App for Anomaly Detection?A: Splunk is officially announcing the ...