It is pushing to summary index, can I push it normal index which I already have? ... View more

Thank you, I could able to extract values of id when FIELDALIAS-cim = findings_summary{}.stats{}.id AS cve to props.conf, but when clicked on individual results, I was not able to see the indexed log or is there anyway I can show results as above SPL query. ... View more

We tried to map CVE field in the Vulnerabilities data model. We have created related tags but data doesn't show in the Vulnerabilities data model when we called by tag in the pivot. Another error we get when we tried to extract "id/name" field from above JSON using Regexis as follows: "The extraction failed. If you are extracting multiple fields, try removing one or more fields. Start with extractions that are embedded within longer text strings." We want to convert the above JSON to the CIM model which has to be mapped to the Vulnerabilities data model. findings_summary: [ [-] { [-] end_date: 1020-01-26 start_date: 1019-11-27 stats: [ [-] { [-] confidence: LOW event_count: 1 first_seen: 1019-11-06 host_count: 1 id: CVE-2011-0117 name: CVE-2011-0117 severity: 7.30 severity_category: null } { [-] confidence: HIGH event_count: 3 first_seen: 10019-08-05 host_count: 3 id: CVE-2011-11581 name: CVE-2011-11581 severity: 9.80 severity_category: null } { [-] confidence: LOW event_count: 1 first_seen: 2011-11-06 host_count: 1 id: CVE-2014-0118 name: CVE-2014-0118 severity: 5.30 severity_category: null } ] ... View more

We are indexing JSON data as raw data into Splunk, can you please guide us. ... View more