Splunk Search

Issue combining 2 sourcetypes into 1 table

Explorer

I am using the following search:

index=nessus sourcetype="nessus:plugin" OR sourcetype="nessus:scan"

each time I pipe that search to the table command and try to display the data from the "interesting fields" (i.e. |table severity, host-ip, description...) only data from 1 sourcetype populates the table, the other fields are left blank. The blank fields are not null, they do contain data, it just does not display and I dont really understand why.

  • it should be noted that I am using this same search construction in another instance of Splunk with nessus data and it renders the table perfectly.
0 Karma

Explorer

alt text

0 Karma

Legend

Can you run the following metadata command to ensure that you actually have data from both sourcetypes?

| metadata type=sourcetypes index="nessus"
| search sourcetype IN ("nessus:plugin","nessus:scan")
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

Explorer

Ran this command as suggested and there is data from both sourcetypes. I will post an image.

0 Karma

Influencer

If you run the search just for the sourcetype in question without table command, do you see the fields on the fields side bar?
The fact that it's working in another splunk instance makes me think that the field extractions are missing for that sourcetype in the current splunk instance you are running.

0 Karma

Explorer
  1. If I search index=nessus sourcetype="nessus:scan" all the (interesting) fields that I am in search of (i.e. plugin_id, host-ip, risk_factor, severity) display in the fields side bar.

  2. Same if I search index=nessus sourcetype="nessus:plugin", (id, solution, synopsis, cve, description) they all show in the fields side bar.

If I search index=nessus sourcetype="nessus:*" - none of the interesting fields display that displayed in #1 above.

I believe something is wrong with the "nessus:scan" data...

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!