Currently, I have a field called pluginText which is the following (italicized words are anonymized to what they represent): <plugin_output> The following software are installed on the remote host: Vendor Software  [version versionnumber] [installed on date] ... ... ... </plugin_output> I wish to extract out Vendor, Software and versionnumber to separate fields and require a rex to do so. I am unfamiliar with using rex on this type of list, so I was hoping someone could point me in the right direction ... View more

So, I have two indexes and sourcetypes with the following fields: index1 and sourcetype1: aip = 34.465.45.234 AppVendor = vendor1, vendor2, vendor3 (These are all from different events) AppName = app2, app3, app1 (All from different events corresponding to position of the vendors above) AppVersion = 3.0343, 1.354, 2.5465 (Same convention) index2 and sourcetype2: jsonevent.external_ip = 34.465.45.234 jsonevent.hostname = Host1 jsonevent.Username = User1 I use the following search: (index=index1 sourcetype=sourcetype1) OR (index=index2 sourcetype=sourcetype2) | rename jsonevent.external_ip as exip | rename aip as agentip | eval external_ip = coalesce(agentip, exip) | stats values(jsonevent.hostname) as Hostnames, values(jsonevent.Username) as Users, values(AppVendor) as Vendors, values(AppName) as Applications, values(AppVersion) as Version by external_ip | search Hostnames=* Users=* Vendors=* Applications=* Version=* I get the following: external_ip                    Hostnames         Usernames              Vendors             Applications                Version 34.465.45.234             Host1                    User1                          Vendor1           app1                                1.354                                                                                                                   Vendor2           app2                                2.5465                                                                                                                    Vendor3           app3                                3.0343   What I want is the following: external_ip                    Hostnames         Usernames              Vendors             Applications                Version 34.465.45.234             Host1                    User1                          Vendor1           app2                                3.0343 34.465.45.234             Host1                    User1                          Vendor2           app3                                1.354  34.465.45.234             Host1                    User1                          Vendor3           app1                                2.5465 Does anyone have any ideas how to achieve this? ... View more

Currently, I have two tables Table1 hostnames        vendors              products          versions host1                   vendor1              product1         version1 host2                   vendor2              product2         version2 host3                   vendor3              product3         version3 host4                   vendor4              product4         version4 Table2 device.hostname        device.username HOST1                                user1 HOST2                                user2 HOST3                                user3 HOST4                                user4 The table that I want to generate from these two is the following: Table3 hosts        username      vendors              products          versions host1                 user1              vendor1              product1         version1 host2                 user2              vendor2              product3         version4 host3                 user3              vendor3              product3         version3 host4                 user4              vendor4              product4         version4   The search I tried was the following:   (index=index1 sourcetype=sourcetype1) OR (index=index2 sourcetype=sourcetype2) | rename device.hostname as hostname | rename device.username as username | eval hosts = coalesce(hostnames, hostname) | table hosts, username, vendors, products, versions   The result was the following: hosts        username      vendors              products          versions host1                                  vendor1              product1         version1 host2                                  vendor2              product3         version4 host3                                  vendor3              product3         version3 host4                                  vendor4              product4         version4 HOST1      user1 HOST2      user2 HOST3      user3 HOST4      user4 host1 and HOST1 both reference the same hostname, just one index had the letters capitalized and the other did not. Does anyone have any ideas? ... View more