Nessus cooked mode: How to configure Splunk to interpret correct format?

[btran]

I installed the forwarder on the nessus server and read the .nessus file. it reads the log and forwader to the indexer. the issue is, Splunk shows as Splunk cooked mode V3. how do i configure so that Splunk interpret the correct format?
thank you

[jcoates_splunk]

Hi, the add-on isn't designed to be used in this way. It needs to parse the .nessus file before inputting it into Splunk. http://docs.splunk.com/Documentation/AddOns/latest/Nessus/ConfigureScriptedInput

[chris2416]

Is there any way to use the Splunk Add-on for Nessus when Nessus is installed on a separate machine? The way the documentation explains it makes it sound like Nussus must be installed on the same machine as your Splunk instance.

[jcoates_splunk]

As long as the .nessus files end up in our spool directory, it will work. Getting the files into the spool could be quite a Rube Goldberg adventure if you're not on the same system, but it's an option.