Splunk Search

Suggestions for Tenable .csv field extraction

Minasdad
Path Finder

Within the tenable:sc:vuln sourcetype there is a particular field "PluginText" that has a value for hardware serial numbers. Overall I'm looking for any source type that provides that data, but extracting "SerialNumber" as a field from "PluginText" is frustrating. Any advice would be appreciated.

Labels (1)
0 Karma

Minasdad
Path Finder

Sample Data:

 pluginText: <plugin_output>

Computer Manufacturer : XXX 

Computer SerialNumber : VMware- XXX

Computer Type : Other Computer

</plugin_output>

 

I wish to extract only the Computer Serial Number Field.

0 Karma

yuanliu
SplunkTrust
SplunkTrust

Can you explain the frustration you had when trying to extract?  Assuming that pluginText is already extracted into a field, you can do something like

| spath input=pluginText ``` this gives you a field plugin_output ```
| rex field=plugin_output "Computer SerialNumber: (?<serialNumber>.+)"

Alternatively, extract all key-value pairs from plugin_output using

| spath input=pluginText ``` this gives you a field plugin_output ```
| rename _raw AS saved_raw, plugin_output AS _raw
| kv kvdelim=" : "
| rename saved_raw as _raw

 

0 Karma

yuanliu
SplunkTrust
SplunkTrust

Pro tip:

  1. Do not use deeply vertical/industry specific/application specific terms in title.
  2. When using such specific sources, illustrate sample data (sanitize as necessary).  This is a Splunk board, most people will not know what tenable:sc:vuln look like. (Source type also has no general meaning outside that particular application.)
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...