Frank,
index=tenable_data severity!="informational" hasBeenMitigated=0
| fields cve, solution
| dedup cve
| mvexpand cve
| rename cve as "CVE ID", solution as "Solution"
| table "CVE ID","Solution"
| sort "CVE ID"
It would have been more useful if I sent you guys my SPL, sorry for not doing that! But, | mvexpand "CVE-ID" would not work, I had to use | mvexpand cve. Could you explain why that is the case? Does | mvexpand not work if a field has been renamed?
Thanks for introducing me to the mvexpand command!!
... View more