All Apps and Add-ons

Nessus cooked mode: How to configure Splunk to interpret correct format?

btran
Explorer

I installed the forwarder on the nessus server and read the .nessus file. it reads the log and forwader to the indexer. the issue is, Splunk shows as Splunk cooked mode V3. how do i configure so that Splunk interpret the correct format?
thank you

0 Karma

jcoates_splunk
Splunk Employee
Splunk Employee

Hi, the add-on isn't designed to be used in this way. It needs to parse the .nessus file before inputting it into Splunk. http://docs.splunk.com/Documentation/AddOns/latest/Nessus/ConfigureScriptedInput

0 Karma

chris2416
Explorer

Is there any way to use the Splunk Add-on for Nessus when Nessus is installed on a separate machine? The way the documentation explains it makes it sound like Nussus must be installed on the same machine as your Splunk instance.

0 Karma

jcoates_splunk
Splunk Employee
Splunk Employee

As long as the .nessus files end up in our spool directory, it will work. Getting the files into the spool could be quite a Rube Goldberg adventure if you're not on the same system, but it's an option.

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...