Currently, I have a search that returns the following:
Search:
index=index1 sourcetype=sourcetype1 | table host, software{}
host software
hostname cpe:/a:vendor:product:version
cpe:/a:vendor:product:version
cpe:/a:vendor:product:version
cpe:/a:vendor:product:version
cpe:/a:vendor:product:version
hostname cpe:/a:vendor:product:version
...
...
Here, there are multiple software tied to one hostname, and the software is under one field called software{}. What I am looking for is a way to split the software field into 3 fields by extracting the vendor, the product and the version into 3 separate fields to return:
host software_vendor software_product software_version
hostname vendor product version
vendor product version
vendor product version
vendor product version
vendor product version
hostname vendor product version
...
...
Does anyone have any ideas?
There are a few ways to do that. I like to use rex.
| rex field=software "cpe:\/a:(?<software_vendor>[^:]+):(?<software_product>[^:]+):(?<software_version>.*)"
There are a few ways to do that. I like to use rex.
| rex field=software "cpe:\/a:(?<software_vendor>[^:]+):(?<software_product>[^:]+):(?<software_version>.*)"
Thanks, this did help me, although now, a new problem arose. When I split the fields, they are not listed in the corresponding order. For example, here is how it was shown originally:
host software{}
hostname cpe:/a:vendorA:product2:version3
cpe:/a:vendorB:product3:version1
cpe:/a:vendorC:product1:version2
With the new rex, it now looks like this:
hostname software_vendor software_product software_version
hostname vendorA product1 version1
vendorB product2 version2
vendorC product3 version3
Is there a way to keep the association between the vendor, product and version after the split?
Never mind, this did not happen. Thanks for the solution!