Splunk Search

Limiting Software Enumeration

mccobalt96
New Member

I would like to modify an existing dashboard to limit the Linux package that is being reported.  Specifically, I want to see any packages that start with kernel.  The plugin that is in use is Software Enumeration (SSH).  The existing query returns too many records and is truncated.  If I could limit it to see kernel packages only I think it would allow the query to complete.  Does anybody have any suggestions how to pass this kernel*?  

Labels (3)
0 Karma

mccobalt96
New Member

I believe I figured it out:

index=server_logs sourcetype="tenable:sc:vuln" pluginName="Software Enumeration (SSH)" dnsName = "$server$"
| rex field=pluginText "Linux system\s\:\s+(?<RPM>[^<]+)"
| rex field=RPM mode=sed "s/\s+/;/g"
| makemv RPM delim=";"
| mvexpand RPM | search RPM="kernel*"
| table dnsName RPM
| dedup dnsName RPM

Unfortunately it includes any kernel-* items not just what I am looking for (i.e. kernel-3.10.*).  If I could limit it to kernel-3* and kernel-2* I think it would get what I need... Any way to do that?  Thanks!

0 Karma

isoutamo
SplunkTrust
SplunkTrust
Nice to hear that you figure it out. Probably this helps you to solve the rest?
https://community.splunk.com/t5/Splunk-Search/How-can-I-use-regex-with-wildcard-patterns-in-a-search...
Another option is | where match or like
r. Ismo
0 Karma

mccobalt96
New Member

I'm hoping this is what you are looking for:  (I'm a newbie).

index=server_logs sourcetype="tenable:sc:vuln" pluginName="Software Enumeration (SSH)" dnsName = "$server$"
| rex field=pluginText "Linux system\s\:\s+(?<RPM>[^<]+)"
| rex field=RPM mode=sed "s/\s+/;/g"
| makemv RPM delim=";"
| mvexpand RPM
| table dnsName RPM
| dedup dnsName RPM

0 Karma

isoutamo
SplunkTrust
SplunkTrust
Can you post your query / dashboard code, so community could help you?
0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...