How to search for critical nessus findings and correlate remediation

[jesperp]

I have my nessus data in splunk, and in my example below I would like to search for all critical findings, and for each of those I would like to correlate the finding with the plugin data and present the details and remediation. The search does not work, and I would like some help if I'm doing this correctly (I'm a complete newbie with the foreach-command).

sourcetype=nessus:scan plugin_id=* severity=critical "host-ip"=* | foreach "host-ip" [search (sourcetype=nessus:scan plugin_id=* severity=critical "host-ip"=<<FIELD>>) OR (sourcetype=nessus:plugin id=*)] | eval match_id=coalesce(id,plugin_id) | stats values(*) AS * by match_id | search plugin_id=* id=* | table host-ip,host_end,match_id,solution,description

[sundareshr]

Try this

(sourcetype=nessus:scan plugin_id=* severity=critical "host-ip"=*) OR (sourcetype=nessus:plugin id=*) | fields host-ip, host_end,  solution, description <<including all relevant fields>> | stats values(*) as * by plugin_id