https://community.splunk.com/t5/Splunk-Search/Need-help-with-Tenable-SC-query/m-p/526278#M148539 <P>Question what is definition of a failed scan?<BR /><BR />Are you referring to setting "Display unreachable host" = Enabled</P><TABLE><TBODY><TR><TD><P>Display unreachable hosts</P></TD><TD><P>Disabled</P></TD><TD><P>When enabled, hosts that did not reply to the ping request are included in the security report as dead hosts.&nbsp;Do not enable this option for large IP blocks.</P></TD></TR></TBODY></TABLE><P><BR />I used to use this setting a lot back in the day;&nbsp; This should show up in pluginID=19506.<BR /><BR />Days since last observed should be more than that of last scan.<BR /><BR /></P><LI-CODE lang="markup">index=nessus sourcetype="tenable:sc:vuln" pluginID=19506</LI-CODE><P>going to need to compare a live/dead hosts pluginText in verbose and see which flag; shows up.&nbsp; Then focus on the needed Rex;&nbsp; next week before I can run a test scan if this is what is meant to dig any further</P> Fri, 23 Oct 2020 19:52:33 GMT kennetkline 2020-10-23T19:52:33Z https://community.splunk.com/t5/Splunk-Search/Need-help-with-Tenable-SC-query/m-p/516403#M145112 <P>I got a search query but I need help displaying the failed scans of the IP or devices. What field I use for that particular search.</P> Wed, 26 Aug 2020 23:08:57 GMT https://community.splunk.com/t5/Splunk-Search/Need-help-with-Tenable-SC-query/m-p/516403#M145112 mackmarvin 2020-08-26T23:08:57Z https://community.splunk.com/t5/Splunk-Search/Need-help-with-Tenable-SC-query/m-p/526278#M148539 <P>Question what is definition of a failed scan?<BR /><BR />Are you referring to setting "Display unreachable host" = Enabled</P><TABLE><TBODY><TR><TD><P>Display unreachable hosts</P></TD><TD><P>Disabled</P></TD><TD><P>When enabled, hosts that did not reply to the ping request are included in the security report as dead hosts.&nbsp;Do not enable this option for large IP blocks.</P></TD></TR></TBODY></TABLE><P><BR />I used to use this setting a lot back in the day;&nbsp; This should show up in pluginID=19506.<BR /><BR />Days since last observed should be more than that of last scan.<BR /><BR /></P><LI-CODE lang="markup">index=nessus sourcetype="tenable:sc:vuln" pluginID=19506</LI-CODE><P>going to need to compare a live/dead hosts pluginText in verbose and see which flag; shows up.&nbsp; Then focus on the needed Rex;&nbsp; next week before I can run a test scan if this is what is meant to dig any further</P> Fri, 23 Oct 2020 19:52:33 GMT https://community.splunk.com/t5/Splunk-Search/Need-help-with-Tenable-SC-query/m-p/526278#M148539 kennetkline 2020-10-23T19:52:33Z