Splunk Search

Suggestions for Tenable .csv field extraction

Minasdad
Path Finder

Within the tenable:sc:vuln sourcetype there is a particular field "PluginText" that has a value for hardware serial numbers. Overall I'm looking for any source type that provides that data, but extracting "SerialNumber" as a field from "PluginText" is frustrating. Any advice would be appreciated.

Labels (1)
0 Karma

Minasdad
Path Finder

Sample Data:

 pluginText: <plugin_output>

Computer Manufacturer : XXX 

Computer SerialNumber : VMware- XXX

Computer Type : Other Computer

</plugin_output>

 

I wish to extract only the Computer Serial Number Field.

0 Karma

yuanliu
SplunkTrust
SplunkTrust

Can you explain the frustration you had when trying to extract?  Assuming that pluginText is already extracted into a field, you can do something like

| spath input=pluginText ``` this gives you a field plugin_output ```
| rex field=plugin_output "Computer SerialNumber: (?<serialNumber>.+)"

Alternatively, extract all key-value pairs from plugin_output using

| spath input=pluginText ``` this gives you a field plugin_output ```
| rename _raw AS saved_raw, plugin_output AS _raw
| kv kvdelim=" : "
| rename saved_raw as _raw

 

0 Karma

yuanliu
SplunkTrust
SplunkTrust

Pro tip:

  1. Do not use deeply vertical/industry specific/application specific terms in title.
  2. When using such specific sources, illustrate sample data (sanitize as necessary).  This is a Splunk board, most people will not know what tenable:sc:vuln look like. (Source type also has no general meaning outside that particular application.)
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...