All Apps and Add-ons

NESSUS Scan digest

hartfoml
Motivator

I am doing a monitor file input of a nessas scan data files.
Splunk reads the files in as one event per line.

The report on each system scaned is between the following to tags in the data file

<ReportHost name="xxx.xxx.xxx.xxx">
</ReportHost>

there can be as many as 3 or 4 hundred lines between these tags

I have two questions

1) What is the best way to put the data into splunk so that all the "ReportHost" info is together for searching reporting on each system?
2) how do I get the multi event information already in the splunk index together into one event for each ReportHost so that I can use the existing data to develop reports?

Tags (1)
0 Karma
1 Solution

yannK
Splunk Employee
Splunk Employee

You have to possibilities :

  • define the event parsing at index time : event breaking

http://docs.splunk.com/Documentation/Splunk/4.2.5/Data/Indexmulti-lineevents

in props.conf of the indexer

[mynessussourcetype]
SHOULD_LINEMERGE=true
BREAK_ONLY_BEFORE =<ReportHost name=
MUST_BREAK_AFTER =</ReportHost>

(the < and > may be missing before.)

and define the timestamp extaction
see http://docs.splunk.com/Documentation/Splunk/4.2.5/Data/Tunetimestampextractionforbetterindexingperfo...

  • or if all your events are indexed as single line events, try to use transactions at search time

see http://docs.splunk.com/Documentation/Splunk/4.2.5/SearchReference/Transaction

sourcetype=mynessussourcetype | transaction startswith="<ReportHost name" endswith="</ReportHost>"

and tune using all the other options (maxspan, maxpause ...)

View solution in original post

yannK
Splunk Employee
Splunk Employee

You have to possibilities :

  • define the event parsing at index time : event breaking

http://docs.splunk.com/Documentation/Splunk/4.2.5/Data/Indexmulti-lineevents

in props.conf of the indexer

[mynessussourcetype]
SHOULD_LINEMERGE=true
BREAK_ONLY_BEFORE =<ReportHost name=
MUST_BREAK_AFTER =</ReportHost>

(the < and > may be missing before.)

and define the timestamp extaction
see http://docs.splunk.com/Documentation/Splunk/4.2.5/Data/Tunetimestampextractionforbetterindexingperfo...

  • or if all your events are indexed as single line events, try to use transactions at search time

see http://docs.splunk.com/Documentation/Splunk/4.2.5/SearchReference/Transaction

sourcetype=mynessussourcetype | transaction startswith="<ReportHost name" endswith="</ReportHost>"

and tune using all the other options (maxspan, maxpause ...)

View solution in original post

hartfoml
Motivator

Thats it thanks this works

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!