Suggestions for Tenable .csv field extraction

[Minasdad]

Within the tenable:sc:vuln sourcetype there is a particular field "PluginText" that has a value for hardware serial numbers. Overall I'm looking for any source type that provides that data, but extracting "SerialNumber" as a field from "PluginText" is frustrating. Any advice would be appreciated.

[Minasdad]

Sample Data:

 pluginText: <plugin_output>

Computer Manufacturer : XXX 

Computer SerialNumber : VMware- XXX

Computer Type : Other Computer

</plugin_output>

I wish to extract only the Computer Serial Number Field.

[yuanliu]

Can you explain the frustration you had when trying to extract?  Assuming that pluginText is already extracted into a field, you can do something like

| spath input=pluginText ``` this gives you a field plugin_output ```
| rex field=plugin_output "Computer SerialNumber: (?<serialNumber>.+)"

Alternatively, extract all key-value pairs from plugin_output using

| spath input=pluginText ``` this gives you a field plugin_output ```
| rename _raw AS saved_raw, plugin_output AS _raw
| kv kvdelim=" : "
| rename saved_raw as _raw

[yuanliu]

Pro tip:

1. Do not use deeply vertical/industry specific/application specific terms in title.
2. When using such specific sources, illustrate sample data (sanitize as necessary).  This is a Splunk board, most people will not know what tenable:sc:vuln look like. (Source type also has no general meaning outside that particular application.)