I added the .nessus file using the old method then I export the csv file then use the splunk spool to add it. Then I create a join to bring the .nessus results and the csv results togather. You have to join on multiple fields. It is a very costly search but it works since I deal with alot of data.
sourcetype=nessus
| rename dest as Host, signature_id as "Plugin ID, dest_ip as "Host_IP"
| join type=outer Host,"Plugin ID" [ search sourcetype=csv
| fields extracted_Host, "Plugin ID", "Plugin Output", Synopsis, Description, Solution, Protocol, "See Also"
| rename extracted_Host as Host ]
| table Host, "Host_IP", "Domain Name", etc...
Make sure you don't turn on use dns name in nessus because it will prevent you from using the IP as your primary key.
... View more