Splunk Search

How to extract multiple values for multiple fields within a single event?

rayaivy
Explorer

I have nessus data for Installed Windows Updates (PluginID 52001).
Here is a list of quick-fix engineering updates installed on the
remote system :

+ KB4091664
  - Description : Update
  - InstalledOn : 1/22/2019

+ KB4132216
  - Description : Update
  - InstalledOn : 6/28/2018

+ KB4465659
  - Description : Security Update
  - InstalledOn : 1/19/2019

+ KB4480977
  - Description : Update
  - InstalledOn : 1/22/2019

Note that for detailed information on installed QFE's such as InstalledBy, Caption,
and so on, please run the scan with 'Report Verbosity' set to 'verbose'.

or in raw

...\nHere is a list of quick-fix engineering updates installed on the\nremote system :\n\n+ KB4091664\n  - Description : Update\n  - InstalledOn : 1/22/2019\n\n+ KB4132216\n  - Description : Update\n  - InstalledOn : 6/28/2018\n\n+ KB4465659\n  - Description : Security Update\n  - InstalledOn : 1/19/2019\n\n+ KB4480977\n  - Description : Update\n  - InstalledOn : 1/22/2019\n\nNote that for detailed information on installed QFE's such as InstalledBy, Caption,\nand so on, please run the scan with 'Report Verbosity' set to 'verbose'.\n...

I tried using the field extractor to no avail.

Need HotFixID, HotFixDesc, HotFixInstalledOn

0 Karma
1 Solution

alemarzu
Motivator

Hi there @rayaivy

Try like this.
... | rex max_match=0 "(?<HotFixID>KB\d+)[^\-]+-\sDescription\s:\s(?<HotFixDesc>[^\-]+)-\sInstalledOn\s:\s(?<HotFixInstalledOn>[\d\/]+)"

View solution in original post

alemarzu
Motivator

Hi there @rayaivy

Try like this.
... | rex max_match=0 "(?<HotFixID>KB\d+)[^\-]+-\sDescription\s:\s(?<HotFixDesc>[^\-]+)-\sInstalledOn\s:\s(?<HotFixInstalledOn>[\d\/]+)"

rayaivy
Explorer
index=nessus pluginID=52001
|  rex max_match=0 "(?<HFID>KB\d+)[^\-]+-\sDescription\s:\s(?<HFDesc>[^\-]+)-\sInstalledOn\s:\s(?<InDate>[\d\/]+)"
| eval allVals=mvzip(HFID,mvzip(HFDesc, InDate,"~"),"~")
| expand allVals
| rex field=allVals "(?<HotFixID>[^~]+)~(?<HotFixDesc>[^~]+)~(?<InstallDate>.*)"
| table dnsName, HotFixID, HotFixDesc, InstallDate
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Maximizing the Value of Splunk ES 8.x

Splunk Enterprise Security (ES) continues to be a leader in the Gartner Magic Quadrant, reflecting its pivotal ...

Operationalizing TDIR: Building a More Resilient, Scalable SOC

Optimizing SOC workflows with a unified, risk-based approach to Threat Detection, Investigation, and Response ...

Introducing .conf Stories Series!

“.conf Stories” Series – First Feature: Rich Mahlerwein   Every year .conf brings together some of the most ...