Splunk Search

How to extract multiple values for multiple fields within a single event?

rayaivy
Explorer

I have nessus data for Installed Windows Updates (PluginID 52001).
Here is a list of quick-fix engineering updates installed on the
remote system :

+ KB4091664
  - Description : Update
  - InstalledOn : 1/22/2019

+ KB4132216
  - Description : Update
  - InstalledOn : 6/28/2018

+ KB4465659
  - Description : Security Update
  - InstalledOn : 1/19/2019

+ KB4480977
  - Description : Update
  - InstalledOn : 1/22/2019

Note that for detailed information on installed QFE's such as InstalledBy, Caption,
and so on, please run the scan with 'Report Verbosity' set to 'verbose'.

or in raw

...\nHere is a list of quick-fix engineering updates installed on the\nremote system :\n\n+ KB4091664\n  - Description : Update\n  - InstalledOn : 1/22/2019\n\n+ KB4132216\n  - Description : Update\n  - InstalledOn : 6/28/2018\n\n+ KB4465659\n  - Description : Security Update\n  - InstalledOn : 1/19/2019\n\n+ KB4480977\n  - Description : Update\n  - InstalledOn : 1/22/2019\n\nNote that for detailed information on installed QFE's such as InstalledBy, Caption,\nand so on, please run the scan with 'Report Verbosity' set to 'verbose'.\n...

I tried using the field extractor to no avail.

Need HotFixID, HotFixDesc, HotFixInstalledOn

0 Karma
1 Solution

alemarzu
Motivator

Hi there @rayaivy

Try like this.
... | rex max_match=0 "(?<HotFixID>KB\d+)[^\-]+-\sDescription\s:\s(?<HotFixDesc>[^\-]+)-\sInstalledOn\s:\s(?<HotFixInstalledOn>[\d\/]+)"

View solution in original post

alemarzu
Motivator

Hi there @rayaivy

Try like this.
... | rex max_match=0 "(?<HotFixID>KB\d+)[^\-]+-\sDescription\s:\s(?<HotFixDesc>[^\-]+)-\sInstalledOn\s:\s(?<HotFixInstalledOn>[\d\/]+)"

rayaivy
Explorer
index=nessus pluginID=52001
|  rex max_match=0 "(?<HFID>KB\d+)[^\-]+-\sDescription\s:\s(?<HFDesc>[^\-]+)-\sInstalledOn\s:\s(?<InDate>[\d\/]+)"
| eval allVals=mvzip(HFID,mvzip(HFDesc, InDate,"~"),"~")
| expand allVals
| rex field=allVals "(?<HotFixID>[^~]+)~(?<HotFixDesc>[^~]+)~(?<InstallDate>.*)"
| table dnsName, HotFixID, HotFixDesc, InstallDate
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...