Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

How to parse RESULTS field from Qualys TA

$
0
0
The Qualys documentation for the TA states that there may be a problem with parsing the RESULTS field because some values are multi-line values. Since this is the only field that may contain a multi-line value, what would be the best way to parse the data? From props.conf: [qualys:hostDetection] DATETIME_CONFIG = NO_BINARY_CHECK = true SHOULD_LINEMERGE = true category = Custom disabled = false KV_MODE = auto KV_MODE = auto parses all the fields correctly, **except** when the RESULTS field has a multi-line value. Thanks in advance!

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>