How to parse a field value that is delimited by "/"

[glenngermiathen]

I have a field for a CVSS vector, and I want to parse it so I can compare each section to a lookup and put it in layman's terms in its own field. For example
CVSS vector
AV:N/AC:L/Au:N/C:N/I:N/A:P

My lookup has two fields
Vector Definition
AV:N Remotely Exploitable
AC:L Easily Exploitable

Then I want a field named
Access_Vector
Remotely Exploitable

and so on. I think Im good on the lookup and creating the table, but how do I parse the cvss vector so I can compare them to the lookup?

[harsmarvania57]

Hi,

Can you please try this query and change field name based on your actual field? First 2 lines are used for generating sample data.

    | makeresults 
    | eval field1="AV:N/AC:L/Au:N/C:N/I:N/A:P"
    | makemv delim="/" field1
    | mvexpand field1
    | lookup <LOOKUP NAME> Vector AS field1 OUTPUT Definition

[glenngermiathen]

@harsmarvania57's answer does work. Just need a little help with the table per the comments above.

| makeresults 
| eval field1="AV:N/AC:L/Au:N/C:N/I:N/A:P"
| makemv delim="/" field1
| mvexpand field1
| lookup  Vector AS field1 OUTPUT Definition

[glenngermiathen]

This works, but a little differently than expected. So now I do have a challenge with the table. How do I get each of the definitions as its own field?

[somesoni2]

What's the final output you expect (based on your sample data)?

[glenngermiathen]

It would look something like this with fields for CVE, Access_Vector, Complexity
CVE Access_Vector Complexity
CVE-2017-1234 Remotely Exploitable Easily Exploitable
CVE-2017-1235 Physical Access Easily Exploitable

[somesoni2]

What are you getting now with @harsmarvania57's answer?

[glenngermiathen]

Now they are each a row in the table with the CVE repeating:
CVE Definition
CVE-2017-1234 Remotely Exploitable
CVE-2017-1234 Easily Exploitable
CVE-2017-1235 Physical Access
CVE-2017-1235 Easily Exploitable

[somesoni2]

Will it always be two rows for each CVE or can be many? If it can be many how do you decide on the column name for it (e.g. in your example results, you've Access_Vector as Remotely Exploitable and Physical Access, and Complexity as Easily Exploitable)

[glenngermiathen]

The number of columns will always be 6, I used 2 in the example for simplicity. Each column can have multiple different values. For the column name I was think of doing an eval or just rename, or I could add it to the lookup if that is more useful.

[somesoni2]

Adding to lookup will be a better option. So, say your lookup now have 3 columns Vector, Name, Definition, your query will be like this

| makeresults 
| eval field1="AV:N/AC:L/Au:N/C:N/I:N/A:P"
| makemv delim="/" field1
| mvexpand field1
| lookup YourLookupHere Vector AS field1 OUTPUT Name as Access_Vector Definition as , Complexity | xyseries CVE Access_Vector Complexity