I have successfully used appendcol to gather percentage of successful and failed scans. I would like to make this data into a pie chart for my dashboard.  When I click visualization-> pie chart it is all one color.    Here is my search    index="secops" sourcetype="tenable:sc:vuln" plugin_id=19506 pluginText!="*Host_Scan*" | dedup ip | search pluginText="*Credentialed checks : no*" | stats count(plugin_id) as failed_scans | appendcols [search index="secops" sourcetype="tenable:sc:vuln" plugin_id=19506 pluginText!="*Host_Scan*" | dedup ip | search pluginText="*Credentialed checks : yes*" | stats count(plugin_id) as successful_scans] | eval total_scans=(failed_scans+successful_scans) | eval failed_percent=(failed_scans/total_scans*100) | eval failed_percent=round(failed_percent,2) | eval success_percent=(successful_scans/total_scans*100) | eval success_percent=round(success_percent,2) | table success_percent failed_percent     Thank you in advanced.  ... View more

I have the tenable TA installed and the data is getting into Splunk correctly, however when looking at the logs the field pluginText is not parsed out correctly. I assume it is because of the additional code in that section of the logs <plugin_output> but I do not know how to break down all the other sub-fields.      patchPubDate: -1 pluginID: 19506 pluginInfo: 19506 (0/6) Nessus Scan Information pluginModDate: 1591977600 pluginName: Nessus Scan Information pluginPubDate: 1125072000 pluginText: <plugin_output>Information about this scan : Nessus version : 8.9.0 Plugin feed version : 202008150609 Scanner edition used : Nessus Scan type : Normal Scan policy used : 95a08a01-72d2-5765-b9ac-e3abc775c2ad-7940724/Copy of Corp Advanced Scan PoC Scanner IP : 10.32.34.182 Port scanner(s) : nessus_syn_scanner Port range : sc-default Thorough tests : no Experimental tests : no Paranoia level : 1 Report verbosity : 1 Safe checks : yes Optimize the test : yes Credentialed checks : no Patch management checks : None CGI scanning : disabled Web application tests : disabled Max hosts : 30 Max checks : 5 Recv timeout : 5 Backports : None Allow post-scan editing: Yes Scan Start Date : 2020/8/17 6:26 EST Scan duration : 1533 sec </plugin_output> plugin_id: 19506 port: 0 protocol: TCP recastRisk: false     Like I would like Splunk to create fields for Scan Start Date, Scan duration... ... View more