topic Re: How to provide a valid start time for the Tenable add-on input? in Getting Data In

How to provide a valid start time for the Tenable add-on input?

hettervik — Mon, 14 Feb 2022 17:52:24 GMT

Hi. I'm trying to add a new input with the Tenable add-on: https://splunkbase.splunk.com/app/4060/

When adding a new input I can input a "start time" from when the add-on will start collection data from Tenable, as opposed to "all time" I suppose, but no matter how I format my timestamp, the add-on won't accept it. See screenshot. I've tried all sort of variations, but all fail. I've also looked at the documentation (https://docs.tenable.com/integrations/Splunk/Content/Splunk2/CreateInput.htm) which suggest another time format than the add-on itself (probably not updated), but that isn't working either.

Has anyone gotten this to work, and if so, what is the correct way of formating the timestamp?

Re: How to provide a valid start time for the Tenable add-on input?

richgalloway — Mon, 14 Feb 2022 16:02:42 GMT

The form says it wants a time in YYYY-mm-ddTHH:MM:SSZ format in the UTC timezone. Have you tried 2022-01-01T00:01:01Z?

Re: How to provide a valid start time for the Tenable add-on input?

hettervik — Tue, 15 Feb 2022 07:41:06 GMT

Thanks, but the format you're suggesting was the first one I tried.

Re: How to provide a valid start time for the Tenable add-on input?

wanderson7 — Sat, 21 May 2022 19:23:53 GMT

Hi, I am not sure if this directly answers your question, but perhaps it could be of some help being that it is Tenable/Nessus related.

I recently developed a free open-source application called TenaPull, which processes Nessus data for ingestion by Splunk. There is more information here:
https://community.splunk.com/t5/Getting-Data-In/I-developed-an-application-to-process-Nessus-data-fo...

GitHub repo:
https://github.com/billyJoePiano/TenaPull

Re: How to provide a valid start time for the Tenable add-on input?

etoombs — Mon, 23 May 2022 18:41:54 GMT

Mine is set formatted as: 2021-01-01T01:01:00Z

Re: How to provide a valid start time for the Tenable add-on input?

etoombs — Mon, 23 May 2022 18:46:34 GMT

I neglected to say that the Z is not representative. It is literally the character Z.

Re: How to provide a valid start time for the Tenable add-on input?

richgalloway — Mon, 23 May 2022 18:58:57 GMT

The literal character 'Z' is representative of the GMT/UTC time zone. It should be written as %Z in a time format string to ensure Splunk applies the right time zone.