I am using the following search:
index=nessus sourcetype="nessus:plugin" OR sourcetype="nessus:scan"
each time I pipe that search to the table command and try to display the data from the "interesting fields" (i.e. |table severity, host-ip, description...) only data from 1 sourcetype populates the table, the other fields are left blank. The blank fields are not null, they do contain data, it just does not display and I dont really understand why.
Can you run the following metadata command to ensure that you actually have data from both sourcetypes?
| metadata type=sourcetypes index="nessus" | search sourcetype IN ("nessus:plugin","nessus:scan")
If you run the search just for the sourcetype in question without table command, do you see the fields on the fields side bar?
The fact that it's working in another splunk instance makes me think that the field extractions are missing for that sourcetype in the current splunk instance you are running.
If I search index=nessus sourcetype="nessus:scan" all the (interesting) fields that I am in search of (i.e. plugin_id, host-ip, risk_factor, severity) display in the fields side bar.
Same if I search index=nessus sourcetype="nessus:plugin", (id, solution, synopsis, cve, description) they all show in the fields side bar.
If I search index=nessus sourcetype="nessus:*" - none of the interesting fields display that displayed in #1 above.
I believe something is wrong with the "nessus:scan" data...