Below is one sanitized raw test event: 2025-03-18 13:03:07.000, ID="484294162", Documentable="No", System="A1234", Group="GSS-27", Environment="3 TEST", Datasource="abcd.test.com", DBMSProduct="MS SQL SERVER", FindingType="Pass", SeverityCode="2 HIGH", SeverityScore="8.0", TestID="0000", TestName="SQL Server must generate audit records when unsuccessful attempts to modify categorized information occur.", TestDescription="Changes in categories of information must be tracked. Without an audit trail, unauthorized access to protected data could go undetected. To aid in diagnosis, it is necessary to keep track of failed attempts in addition to the successful ones. For detailed information on categorizing information, refer to FIPS Publication 199, Standards for Security Categorization of Federal Information and Information Systems, and FIPS Publication 200, Minimum Security Requirements for Federal Information and Information Systems. If auditing the modification of data classifications is not required, this is not applicable.", FindingDescription="Auditing unsuccessful attempts to modify categorized information is set up correctly.", TestResultID="123456789101112131415", RemediationRule="1", RemediationAssignment="N/A", RemediationAnalysis="This test passed. No remediation necessary.", RemediationGuidance="No action required.", ExternalReference="STIG_Reference - SQL6-D0-014000 : STIG_SRG - SRG-APP-000498-DB-000347", VersionLevel="16.0", PatchLevel="0000", Reference="Sample14", VulnerabilityType="CONF", ScanTimestamp="2025-03-18 09:03:07.0000000", FirstExecution="2022-12-06 10:08:32.0000000", LastExecution="2025-03-18 09:03:35.0000000", CurrentScore="Pass", CurrentScoreSince="2022-12-06 10:08:32.0000000", CurrentScoreDays="833", AcknowledgedServiceAccount="No", SecurityAssessmentName="A1234_TEST (MS SQL SERVER)", CollectorID="testcollector", ScanYear="2025", ScanMonth="3", ScanDay="18", ScanCycle="2", Description="A1234;TEST;GSS-27", Host="12345.sample.test.com", Port="1234" ... View more

@ITWhisperer  I made adjustments as you suggested above and getting below results. Using one system and group sample. Running search for 6 months and need to see 0 for the months with no data/events. Above adjustments give only the months with data. System Group ScanMonth ScanYear Environment TOTAL 1_LOW 2_MEDIUM 3_HIGH 4_CRITICAL A1234 GSS-27 2 2025 3_TEST 216 2 28 155 31 A1234 GSS-27 3 2025 3_TEST 430 4 56 308 62 A1234 GSS-27 2 2025 4_DEV 222 2 28 161 31 A1234 GSS-27 3 2025 4_DEV 444 4 56 322 62   Needed: System Group ScanMonth ScanYear Environment TOTAL 1_LOW 2_MEDIUM 3_HIGH 4_CRITICAL A6020B GSS-27 1 2025 3_TEST 0 0 0 0 0 A6020B GSS-27 2 2025 3_TEST 216 2 28 155 31 A6020B GSS-27 3 2025 3_TEST 430 4 56 308 62 A6020B GSS-27 1 2025 4_DEV 0 0 0 0 0 A6020B GSS-27 2 2025 4_DEV 222 2 28 161 31 A6020B GSS-27 3 2025 4_DEV 444 4 56 322 62 A6020B GSS-27 10 2024 3_TEST 0 0 0 0 0 A6020B GSS-27 11 2025 3_TEST 0 0 0 0 0 A6020B GSS-27 12 2026 3_TEST 0 0 0 0 0 A6020B GSS-27 10 2027 4_DEV 0 0 0 0 0 A6020B GSS-27 11 2028 4_DEV 0 0 0 0 0 A6020B GSS-27 12 2029 4_DEV 0 0 0 0 0 ... View more

Thank you @livehybrid !!!!! I knew I was dosing off at the end of the day.... LOL ... View more

@dural_yyz yes, field names are kept different. ... View more

Thanks @richgalloway!! ... View more

Hi @ITWhisperer  Patience is a virtue and tolerance is the by product of it including many other things. Specially when the trunk has a sticker "Student driver"! 😁 Btw, I did explain everything well, however @yuanliu added a little more clarity with mentioning (1) and (2). Appreciate ya' all as always!!! Don't lose patience 😋😜 ... View more

Hi @yuanliu This was it! It worked per your solution. Thank you!!!😊 ... View more

Hi yuanliu, I did try that. See my notes in parenthesis. I will try to explain again. namespace      imageName c-esm-sat        c-ecm-dev/das-dynamic-filter-services/sample                               (there is no space nor any delimiter between the 1st value at the top and the 2nd one below)                                c-ecm-sat/irtf-das-service Final results need to be: namespace                      Environment        imageName c-esm-sat                        c-ecm-dev            /das-dynamic-filter-services c-esm-sat                        c-ecm-dev            /sample c-esm-sat                        c-ecm-sat             /irtf-das-service ... View more

Hi yuanlu,   Yes it does. See below from Event #3: imageName="raas/jggmb/graph-analysis" Which is actually needed as below since there can be multiple imageName in each namespace separated by /: namespace    imageName NULL                        raas NULL                        iggmb NULL                        graph-analysis The challenge is not the /, it is that imageName can be multivalued field as below which I had mentioned in the very first post sample. The issue is the mv because there is no  delimiter between the first and second value of mv as shown below: namespace                      imageName c-esm-sat                        c-ecm-dev/das-dynamic-filter-services/sample                                               c-ecm-sat/irtf-das-service And this needs to be first extracted as below: namespace                      imageName c-esm-sat                        c-ecm-dev/das-dynamic-filter-services/sample c-esm-sat                        c-ecm-sat/irtf-das-service And final results are to be: namespace                      Environment        imageName c-esm-sat                        c-ecm-dev            /das-dynamic-filter-services c-esm-sat                        c-ecm-dev            /sample c-esm-sat                        c-ecm-sat             /irtf-das-service Also, the first group is the Environment as I highlighted in red above. I am not worried about Environment because if I can have the value 1 and value 2 separated, It can them delimit Environment easily. I hope I explained better this time. ... View more

Hi folks, See below 4 samples. Field names are namespace and imageName in the events. Much appreciated!!! 07/14/2023 23:37:50 +0000, search_name="Sample", search_now=1689379860.000, info_min_time=1686787200.000, info_max_time=1689379897.133, info_search_time=1689379894.139, IP=NULL, OS=NULL, DNS=NULL, GSS=NULL, qid=650035, AO=NULL, cveids="CVE-2020-14145", result="Vulnerable version of OpenSSH Detected:OpenSSH_8.2p1 Ubuntu-4ubuntu0.5, OpenSSL 1.1.1f  31 Mar 2020", imageId=45a89e408277, isDrift=false, CATEGORY=NULL, ISSO=NULL, PROJECTS=NULL, hostname="test.com", imageSha=000000000000000000000000000000, os_group=NULL, LAST_SEEN=NULL, imageName="raas/jggmb/graph-analysis", imageUuid="0000000000-000000000000-000000000", namespace=NULL, vulnTitle="OpenSSH Information Disclosure Vulnerability (Generic)", containerState=RUNNING, softwareFixVersion=NULL, PRJ_GROUP_EMAIL=NULL, Business_Group=UNASSIGNED, vulnFirstfound="2023-07-06T18:16:21Z", imageScanType=null, POC_EMAIL=NULL, cvss3TemporalScore="5.4", SYSTEMNAME=NULL, RESPONSIBILITY_CODE=NULL, vulnLastfound="2023-07-06T18:16:21Z", cvss3BaseScore="5.9", AO_EMAIL=NULL, POC_NAME=NULL, PRJ_NAME=NULL, Severity=Moderate, Environment=NULL, containerId=000000000000, EMAIL=NULL, containerSha=000000000000000000000000000000000, softwareVersion=NULL, softwareName=NULL, vulnCategory="Security Policy", vulnSolution="OpenSSH team committed a partial mitigation of this issue which is included in openssh 8.4.<BR> Refer to <A HREF='https://www.openssh.com/' TARGET='_blank'>OpenSSH 8.4</A> for details.<P>", containerCreated="2023-07-06T18:08:01Z", containerUpdated="2023-07-06T18:16:21Z"     07/15/2023 00:10:08 +0000, search_name="sample", search_now=1689379860.000, info_min_time=1686787200.000, info_max_time=1689379897.133, info_search_time=1689379894.139, IP="0.0.0.0", OS="Red Hat Enterprise Linux Server 7.9", DNS="sample.com", GSS="TestGSS", qid=199358, AO=NULL, cveids="CVE-2019-17594 CVE-2019-17595 CVE-2021-39537 CVE-2022-29458 CVE-2023-29491", result="#table cols=\"3\" Package Installed_Version Required_Version libtinfo6 6.2-0ubuntu2 6.2-0ubuntu2.1 libncurses6 6.2-0ubuntu2 6.2-0ubuntu2.1 ncurses-bin 6.2-0ubuntu2 6.2-0ubuntu2.1 ncurses-base 6.2-0ubuntu2 6.2-0ubuntu2.1 libncursesw6 6.2-0ubuntu2 6.2-0ubuntu2.1", imageId=976ed922248e, isDrift=true, CATEGORY=SERVER, ISSO=NULL, PROJECTS=NULL, hostname="test.com", imageSha=00000000000000000000000000, os_group="RHEL 7", LAST_SEEN="2023-07-14T07:32:50Z", imageName="raas/cdw-api", imageUuid="000000000000-0000000000000000-00000000000", namespace=xyz, vulnTitle="Ubuntu Security Notification for ncurses Vulnerabilities (USN-6099-1)", containerState=RUNNING, softwareFixVersion="6.2-0ubuntu2.1", PRJ_GROUP_EMAIL=NULL, Business_Group=UNASSIGNED, vulnFirstfound="2023-05-27T00:52:20Z", imageScanType=null, POC_EMAIL=NULL, cvss3TemporalScore="7.9", SYSTEMNAME=ADMIN, RESPONSIBILITY_CODE="ABC Group", vulnLastfound="2023-07-13T20:02:42Z", cvss3BaseScore="8.8", AO_EMAIL=NULL, POC_NAME=NULL, PRJ_NAME=NULL, Severity=High, Environment=NULL, containerId=00000000000, ISSO_EMAIL=NULL, containerSha=0000000000000000000000000000000000000000, softwareVersion="6.2-0ubuntu2", softwareName="libncurses6:amd64 libncursesw6:amd64 libtinfo6:amd64 ncurses-base ncurses-bin", vulnCategory=Ubuntu, vulnSolution="Refer to Ubuntu security advisory <A HREF='https://ubuntu.com/security/notices/USN-6099-1' TARGET='_blank'>USN-6099-1</A> for updates and patch information. <P>Patch:<BR> Following are links for downloading patches to fix the vulnerabilities: <P> <A HREF='https://ubuntu.com/security/notices/USN-6099-1' TARGET='_blank'>USN-6099-1:Ubuntu Linux</A>", containerCreated="2023-05-18T23:41:47Z", containerUpdated="2023-07-13T20:02:42Z"     07/14/2023 23:43:10 +0000, search_name="Sample", search_now=1689379860.000, info_min_time=1686787200.000, info_max_time=1689379897.133, info_search_time=1689379894.139, IP=NULL, OS=NULL, DNS=NULL, GSS=NULL, qid=106124, AO=NULL, cveids=NULL, result="#table cols=\"1\" End_of_Life_Node.js_version_Detected___node:_'17.8.0',_/opt/conda/envs/rapids", imageId=bd2ba01f6d48, isDrift=false, CATEGORY=NULL, ISSO=NULL, PROJECTS=NULL, hostname="sample.com", imageSha=000000000000000000000000000000000, os_group=NULL, LAST_SEEN=NULL, imageName="raas/bpa-lab/rapidsai-22.08-cuda11.4-centos7-py3.8", imageUuid="000000000000-0000000000000-0000000000000", namespace=NULL, vulnTitle="EOL/Obsolete Software: Node.js 17.x Detected", containerState=RUNNING, softwareFixVersion=NULL, PRJ_GROUP_EMAIL=NULL, Business_Group=UNASSIGNED, vulnFirstfound="2023-07-11T18:47:56Z", imageScanType=null, POC_EMAIL=NULL, cvss3TemporalScore="9.0", SYSTEMNAME=NULL, RESPONSIBILITY_CODE=NULL, vulnLastfound="2023-07-13T21:54:18Z", cvss3BaseScore="9.8", AO_EMAIL=NULL, POC_NAME=NULL, PRJ_NAME=NULL, Severity=Critical, Environment=NULL, containerId=000000000000, ISSO_EMAIL=NULL, containerSha=00000000000000000000000000, softwareVersion=NULL, softwareName=NULL, vulnCategory="Security Policy", vulnSolution=NULL, containerCreated="2023-07-11T18:37:46Z", containerUpdated="2023-07-13T21:54:18Z"     07/15/2023 12:06:38 +0000, search_name="Sample", search_now=1689423060.000, info_min_time=1686787200.000, info_max_time=1689423094.363, info_search_time=1689423092.507, IP="0.0.0.0", OS="Red Hat Enterprise Linux Server 7.9", DNS="sample.com", GSS="Test1", qid=180276, AO=NULL, cveids="CVE-2021-46663", result="#table cols=\"3\" Package Installed_Version Required_Version mariadb-common 1:10.3.18-0+deb10u1 1:10.3.36-0+deb10u2 libmariadb3 1:10.3.18-0+deb10u1 1:10.3.36-0+deb10u2", imageId=cf879a45faaa, isDrift=true, CATEGORY=SERVER, ISSO=NULL, PROJECTS=ABC, hostname="sample.com", imageSha=000000000000000000, os_group="RHEL 7", LAST_SEEN="2023-07-15T00:59:17Z", imageName=postgres, imageUuid="0000000000000000", namespace=abcd, vulnTitle="Debian Security Update for mariadb-10.5mariadb-10.3 (CVE-2021-46663)", containerState=RUNNING, softwareFixVersion="1:10.3.36-0+deb10u2", PRJ_GROUP_EMAIL=NULL, Business_Group=UNASSIGNED, vulnFirstfound="2023-01-13T22:09:56Z", imageScanType=null, POC_EMAIL=NULL, cvss3TemporalScore="5.0", SYSTEMNAME=CDW, RESPONSIBILITY_CODE="XYZ", vulnLastfound="2023-06-20T18:38:31Z", cvss3BaseScore="5.5", AO_EMAIL=NULL, POC_NAME=NULL, PRJ_NAME=NULL, Severity=Moderate, Environment=NULL, containerId=0d74dc575dfb, ISSO_EMAIL=NULL, containerSha=0000000000000000000000000000000000000000, softwareVersion="1:10.3.18-0+deb10u1", softwareName="libmariadb3:amd64 mariadb-common", vulnCategory=Debian, vulnSolution="Refer to Debian security advisory <A HREF='https://security-tracker.debian.org/tracker/CVE-2021-46663' TARGET='_blank'>CVE-2021-46663</A> for updates and patch information. <P>Patch:<BR> Following are links for downloading patches to fix the vulnerabilities: <P> <A HREF='https://security-tracker.debian.org/tracker/CVE-2021-46663' TARGET='_blank'>CVE-2021-46663:Debian</A>", containerCreated="2020-05-08T01:54:27Z", containerUpdated="2023-06-20T21:20:51Z" ... View more

Hi @gcusello See few raw samples below. Field names are imageName and namespace. I have everything coming normalized except imageName which need to be split up inparallel with namespace the way I have provided in Table B. Sample1: 07/13/2023 17:55:05 +0000, search_name="Sample", search_now=1689271860.000, info_min_time=1686614400.000, info_max_time=1689271894.612, info_search_time=1689271892.776, IP="1.2.3.4", OS="Red Hat Enterprise Linux CoreOS 4.11", DNS=sampledns1, GSS="sample1", qid=241759, AO="user1.com", cveids="CVE-2023-1667 CVE-2023-2283", result="#table cols=\"3\" Package Installed_Version Required_Version libssh-config 0.9.6-3.el8.noarch 0.9.6-10.el8__8 libssh 0.9.6-3.el8.x86__64 0.9.6-10.el8__8", imageId=05ac522d3e87, isDrift=false, CATEGORY=SERVER, ISSO="sampleisso1", PROJECTS=NULL, hostname=sampledns1, imageSha=0000000000000000000000000000000000000000, os_group=OTHER, LAST_SEEN="2023-07-12T20:18:15Z", imageName="<none>", imageUuid="0000000000000000000000", namespace="c-ecm-dev", vulnTitle="Red Hat Update for libssh (RHSA-2023:3839)", containerState=RUNNING, softwareFixVersion="0.9.6-10.el8__8", PRJ_GROUP_EMAIL="[email protected]", Business_Group=UNASSIGNED, vulnFirstfound="2023-07-13T06:35:03Z", imageScanType=null, POC_EMAIL="[email protected]", cvss3TemporalScore="5.9", SYSTEMNAME=NULL, RESPONSIBILITY_CODE="sample respcode", vulnLastfound="2023-07-13T06:35:03Z", cvss3BaseScore="6.5", AO_EMAIL="sampleemail.com", POC_NAME="sample user", PRJ_NAME=ABC, Severity=Moderate, Environment=DEV, containerId=123456789, ISSO_EMAIL="sample3.com", containerSha=000000000000000000000000000000000000000000, softwareVersion="0.9.6-3.el8", softwareName="libssh libssh-config", vulnCategory=RedHat, vulnSolution="Refer to Red Hat security advisory <A HREF='https://access.redhat.com/errata/RHSA-2023:3839' TARGET='_blank'>RHSA-2023:3839</A> for updates and patch information. <P>Patch:<BR> Following are links for downloading patches to fix the vulnerabilities: <P> <A HREF='https://access.redhat.com/errata/RHSA-2023:3839' TARGET='_blank'>RHSA-2023:3839:Red Hat Enterprise Linux</A>", containerCreated="2023-07-13T06:31:14Z", containerUpdated="2023-07-13T06:35:03Z" Sample2: 07/14/2023 11:39:39 +0000, search_name="sample", search_now=1689336660.000, info_min_time=1686700800.000, info_max_time=1689336695.166, info_search_time=1689336692.365, IP=NULL, OS=NULL, DNS=NULL, GSS=NULL, qid=500500, AO=NULL, cveids="CVE-2022-0778", result="#table cols=\"3\" Package Installed_Version Required_Version libcrypto1.1 1.1.1k-r0 1.1.1n-r0 libssl1.1 1.1.1k-r0 1.1.1n-r0", imageId=24ae535b6904, isDrift=false, CATEGORY=NULL, ISSO=NULL, PROJECTS=NULL, hostname=samplehost, imageSha=000000000000000000000000000000, os_group=NULL, LAST_SEEN=NULL, imageName="c-ecm-dev/mtrdb-integration", imageUuid="000000000-00000000000000000-000000000000000", namespace="sysdig-sdc-cli", vulnTitle="Alpine Linux Security Update for Open Secure Sockets Layer (OpenSSL)", containerState=RUNNING, softwareFixVersion="1.1.1n-r0", PRJ_GROUP_EMAIL=NULL, Business_Group=UNASSIGNED, vulnFirstfound="2023-07-09T18:18:06Z", imageScanType=null, POC_EMAIL=NULL, cvss3TemporalScore="6.7", SYSTEMNAME=NULL, RESPONSIBILITY_CODE=NULL, vulnLastfound="2023-07-09T18:18:06Z", cvss3BaseScore="7.5", AO_EMAIL=NULL, POC_NAME=NULL, PRJ_NAME=NULL, Severity=High, Environment=NULL, containerId=123456789, ISSO_EMAIL=NULL, containerSha=000000000000000000000000000000000000, softwareVersion="1.1.1k-r0", softwareName="libcrypto1.1 libssl1.1", vulnCategory="Alpine Linux", vulnSolution="Refer to Alpine Linux advisory <A HREF='https://security.alpinelinux.org/srcpkg/openssl' TARGET='_blank'>openssl</A> for updates and patch information. <P>Patch:<BR> Following are links for downloading patches to fix the vulnerabilities: <P> <A HREF='https://security.alpinelinux.org/srcpkg/openssl' TARGET='_blank'>openssl-1.1.1n-r0:Alpine Linux</A>", containerCreated="2023-07-09T18:13:48Z", containerUpdated="2023-07-09T18:18:06Z" Sample3: 07/13/2023 17:40:56 +0000, search_name="sample", search_now=1689271860.000, info_min_time=1686614400.000, info_max_time=1689271894.612, info_search_time=1689271892.776, IP="0.0.0.0", OS="Red Hat Enterprise Linux CoreOS 4.11", DNS=sampledns, GSS="samplegss", qid=241757, AO="[email protected]", cveids="CVE-2023-26604", result="#table cols=\"3\" Package Installed_Version Required_Version systemd-libs 239-68.el8__7.4.x86__64 239-74.el8__8.2", imageId=dcbb6b8e07e2, isDrift=false, CATEGORY=SERVER, ISSO="sample", PROJECTS=NULL, hostname=samplehostname, imageSha=00000000000000000000000000000000, os_group=OTHER, LAST_SEEN="2023-07-12T20:33:03Z", imageName="wi-irps-sat/ir-data-certification-sat c-ecm-dev/irtf-das-service", imageUuid="0000000000-00000000000-000000000000", namespace="c-ecm-dev", vulnTitle="Red Hat Update for systemd (RHSA-2023:3837)", containerState=RUNNING, softwareFixVersion="239-74.el8__8.2", PRJ_GROUP_EMAIL="[email protected]", Business_Group=UNASSIGNED, vulnFirstfound="2023-07-03T10:55:11Z", imageScanType="null null", POC_EMAIL="[email protected]", cvss3TemporalScore="7.0", SYSTEMNAME=NULL, RESPONSIBILITY_CODE="ENTERPRISE CONTAINER", vulnLastfound="2023-07-03T10:55:11Z", cvss3BaseScore="7.8", AO_EMAIL="[email protected]", POC_NAME="sample user", PRJ_NAME=ECM, Severity=High, Environment=DEV, containerId=1234564897, ISSO_EMAIL="[email protected]", containerSha=0000000000000000000000000000000000, softwareVersion="239-68.el8_7.4", softwareName="systemd-libs", vulnCategory=RedHat, vulnSolution="Refer to Red Hat security advisory <A HREF='https://access.redhat.com/errata/RHSA-2023:3837' TARGET='_blank'>RHSA-2023:3837</A> for updates and patch information. <P>Patch:<BR> Following are links for downloading patches to fix the vulnerabilities: <P> <A HREF='https://access.redhat.com/errata/RHSA-2023:3837' TARGET='_blank'>RHSA-2023:3837:Red Hat Enterprise Linux</A>", containerCreated="2023-07-03T10:51:50Z", containerUpdated="2023-07-03T10:55:11Z"   ... View more

Hi @VatsalJagani  I had tried it and it did not work. ... View more

Slight adjustment and  worked out great. Thank you @richgalloway !!! ... View more

Hi @richgalloway  Can you tell me how did you test below? Any makeresults etc. to test it via search? Thanks! ... View more

Hi @ ITWhisperer, I did below before your response and it is working. Did I do this correctly or should I use your version of rex? | rex "FindingDetails=\"(?<FindingDetailsE>[^,]*)\"" | rex "FindingDescription=\"(?<FindingDescriptionE>[^,]*)\"" ... View more

@VatsalJagani  How have you tested your provided regex in splunk search? I see a slight tweak in yours vs mine. Mine is out there in production so I need to be definitive so please provide test search you have used. Also, can it be search time extraction and if yes then how? Thanks in advance!!! ... View more

Hi @richgalloway, When I had ingested original dataset, I had used key value pairs to extract a lot of information per requirements and that has been working flawlessly until new requirements came to extract this information.   The rex for field transformation I have been using for this dataset that works as needed is: (\r|\n)*(?<_KEY_1>[^:]+):(?<_VAL_1>[^\r\n]+) Automatically clean field names option is enabled. Thanks! ... View more