Quantcast
Channel: Latest Questions on Splunk Answers
Viewing all articles
Browse latest Browse all 13053

Extracting individual lines from a single field

$
0
0

Hello,

I am working with Nessus data and I am trying to pull a software list from the results. Nessus exports this data in a single field:

The following software are installed on the remote host :
Cisco WebEx Meetings
OpenSSL-0.9.7c Binaries (GnuWin32)  [version 0.9.7c]
Python 2.5 elementtree-1.2.6-20050316
Python 2.5 pycrypto-2.0.1
Python 2.5 pywin32-211
McAfee VirusScan Enterprise  [version 8.7.0]  [installed on 2010/09/08]
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148  [version 9.0.30729.4148] [installed on 2010/09/14]
Microsoft SQL Server 2008 Management Objects  [version 10.1.2531.0]  [installed on 2012/10/18]
ActiveWatchIse  [version 1.0.0]  [installed on 2010/09/14]
AWMonitorSvcSetup  [version 1.0.0]  [installed on 2010/09/14]
Python 2.5.2  [version 2.5.2150]  [installed on 2010/09/14]
Microsoft Visual C++ 2005 Redistributable  [version 8.0.61001]  [installed on 2012/12/16]
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161  [version 9.0.30729.6161]  [installed on 2012/12/16]
Xiotech ISE Manager   [version 3.1.5.4]  [installed on 2012/10/18]
McAfee Agent  [version 4.5.0.1270]  [installed on 2011/05/02]
SQL Server System CLR Types  [version 10.1.2531.0]  [installed on 2012/10/18]
VMware Tools  [version 8.3.18.20074]  [installed on 2013/02/24]

I need to "table" each of the above lines with a matching Host/Software pair. I cannot figure out how to parse this field correctly.

I have tried:

rex field=Plugin_Output "(?< software>.*\n)"  (extra space only for display)
makemv delim="\n", Plugin_Output

Any assistance with this one?


Viewing all articles
Browse latest Browse all 13053

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>