Splunk Search

Issue combining 2 sourcetypes into 1 table

cc3658
Explorer

I am using the following search:

index=nessus sourcetype="nessus:plugin" OR sourcetype="nessus:scan"

each time I pipe that search to the table command and try to display the data from the "interesting fields" (i.e. |table severity, host-ip, description...) only data from 1 sourcetype populates the table, the other fields are left blank. The blank fields are not null, they do contain data, it just does not display and I dont really understand why.

  • it should be noted that I am using this same search construction in another instance of Splunk with nessus data and it renders the table perfectly.
0 Karma

cc3658
Explorer

alt text

0 Karma

niketn
Legend

Can you run the following metadata command to ensure that you actually have data from both sourcetypes?

| metadata type=sourcetypes index="nessus"
| search sourcetype IN ("nessus:plugin","nessus:scan")
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

cc3658
Explorer

Ran this command as suggested and there is data from both sourcetypes. I will post an image.

0 Karma

pradeepkumarg
Influencer

If you run the search just for the sourcetype in question without table command, do you see the fields on the fields side bar?
The fact that it's working in another splunk instance makes me think that the field extractions are missing for that sourcetype in the current splunk instance you are running.

0 Karma

cc3658
Explorer
  1. If I search index=nessus sourcetype="nessus:scan" all the (interesting) fields that I am in search of (i.e. plugin_id, host-ip, risk_factor, severity) display in the fields side bar.

  2. Same if I search index=nessus sourcetype="nessus:plugin", (id, solution, synopsis, cve, description) they all show in the fields side bar.

If I search index=nessus sourcetype="nessus:*" - none of the interesting fields display that displayed in #1 above.

I believe something is wrong with the "nessus:scan" data...

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...