I have my nessus data in splunk, and in my example below I would like to search for all critical findings, and for each of those I would like to correlate the finding with the plugin data and present the details and remediation. The search does not work, and I would like some help if I'm doing this correctly (I'm a complete newbie with the foreach-command).
sourcetype=nessus:scan plugin_id=* severity=critical "host-ip"=* | foreach "host-ip" [search (sourcetype=nessus:scan plugin_id=* severity=critical "host-ip"=<<FIELD>>) OR (sourcetype=nessus:plugin id=*)] | eval match_id=coalesce(id,plugin_id) | stats values(*) AS * by match_id | search plugin_id=* id=* | table host-ip,host_end,match_id,solution,description
