Splunk Search

Suggestions for Tenable .csv field extraction

Minasdad
Path Finder

Within the tenable:sc:vuln sourcetype there is a particular field "PluginText" that has a value for hardware serial numbers. Overall I'm looking for any source type that provides that data, but extracting "SerialNumber" as a field from "PluginText" is frustrating. Any advice would be appreciated.

Labels (1)
0 Karma

Minasdad
Path Finder

Sample Data:

 pluginText: <plugin_output>

Computer Manufacturer : XXX 

Computer SerialNumber : VMware- XXX

Computer Type : Other Computer

</plugin_output>

 

I wish to extract only the Computer Serial Number Field.

0 Karma

yuanliu
SplunkTrust
SplunkTrust

Can you explain the frustration you had when trying to extract?  Assuming that pluginText is already extracted into a field, you can do something like

| spath input=pluginText ``` this gives you a field plugin_output ```
| rex field=plugin_output "Computer SerialNumber: (?<serialNumber>.+)"

Alternatively, extract all key-value pairs from plugin_output using

| spath input=pluginText ``` this gives you a field plugin_output ```
| rename _raw AS saved_raw, plugin_output AS _raw
| kv kvdelim=" : "
| rename saved_raw as _raw

 

0 Karma

yuanliu
SplunkTrust
SplunkTrust

Pro tip:

  1. Do not use deeply vertical/industry specific/application specific terms in title.
  2. When using such specific sources, illustrate sample data (sanitize as necessary).  This is a Splunk board, most people will not know what tenable:sc:vuln look like. (Source type also has no general meaning outside that particular application.)
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...