Issue combining 2 sourcetypes into 1 table

[cc3658]

I am using the following search:

index=nessus sourcetype="nessus:plugin" OR sourcetype="nessus:scan"

each time I pipe that search to the table command and try to display the data from the "interesting fields" (i.e. |table severity, host-ip, description...) only data from 1 sourcetype populates the table, the other fields are left blank. The blank fields are not null, they do contain data, it just does not display and I dont really understand why.

• it should be noted that I am using this same search construction in another instance of Splunk with nessus data and it renders the table perfectly.

[cc3658]

[niketn]

Can you run the following metadata command to ensure that you actually have data from both sourcetypes?

| metadata type=sourcetypes index="nessus"
| search sourcetype IN ("nessus:plugin","nessus:scan")

[cc3658]

Ran this command as suggested and there is data from both sourcetypes. I will post an image.

[pradeepkumarg]

If you run the search just for the sourcetype in question without table command, do you see the fields on the fields side bar?
The fact that it's working in another splunk instance makes me think that the field extractions are missing for that sourcetype in the current splunk instance you are running.

[cc3658]

1. If I search index=nessus sourcetype="nessus:scan" all the (interesting) fields that I am in search of (i.e. plugin_id, host-ip, risk_factor, severity) display in the fields side bar.

2. Same if I search index=nessus sourcetype="nessus:plugin", (id, solution, synopsis, cve, description) they all show in the fields side bar.

If I search index=nessus sourcetype="nessus:*" - none of the interesting fields display that displayed in #1 above.

I believe something is wrong with the "nessus:scan" data...