All Apps and Add-ons

Splunk Add-on for Nessu: Why is my search not retrieving all events from the Nessus scan?

dgillette2
New Member

Wondering if anyone else is seeing this problem. I configured the Splunk add-on for Nessus without any problems. I'm able to search for Nessus events in Splunk, however, I'm not seeing all the events I'm expecting to see.

First I ran a host discovery scan in Nessus.

I then ran this search in Splunk to only pull the events from that scan:

sourcetype=nessus:scan name = "Host discovery scan"

The Nessus scan discovered 294 hosts, yet the Splunk search only returned 248 hosts. I've racked my brains trying to figure out why but came up short. Any ideas what could be happening here?

alt text

0 Karma

jcoates_splunk
Splunk Employee
Splunk Employee
0 Karma

dgillette2
New Member

Nothing that would indicate why I'm unable to see all events, to me at least.

alt text

0 Karma

s2_splunk
Splunk Employee
Splunk Employee

Is there a chance that some of the events in splunk don't have a value in the "name" field?
Is your search timeframe (4 hours) the same as the timeframe covered by the scan, i.e. same start and end time (and are the timezone settings the same?)?
What values do you get when you run sourcetype=nessus:scan | stats values(name)?

dgillette2
New Member

Is there a chance that some of the events in splunk don't have a value in the "name" field? I don't see how that's possible. Also if I do this search sourcetype=nessus:scan I get the same results so the name field can't be the issue.

Is your search timeframe (4 hours) the same as the timeframe covered by the scan, i.e. same start and end time (and are the timezone settings the same?)? Yes, the Nessus scan was run on 2/1 at 4:50 PM and completed in 38 minutes. You can see in the image above that my Splunk time frame is well within the Nessus time frame.

What values do you get when you run sourcetype=nessus:scan | stats values(name)? I ran my exact same search today and now I'm only getting 3 events. Maddening! I ran your search and got the same 3 events.
It's looking to me like the add-on is jacked up.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...