All Apps and Add-ons

Splunk Add-on for Nessu: Why is my search not retrieving all events from the Nessus scan?

New Member

Wondering if anyone else is seeing this problem. I configured the Splunk add-on for Nessus without any problems. I'm able to search for Nessus events in Splunk, however, I'm not seeing all the events I'm expecting to see.

First I ran a host discovery scan in Nessus.

I then ran this search in Splunk to only pull the events from that scan:

sourcetype=nessus:scan name = "Host discovery scan"

The Nessus scan discovered 294 hosts, yet the Splunk search only returned 248 hosts. I've racked my brains trying to figure out why but came up short. Any ideas what could be happening here?

alt text

0 Karma

Splunk Employee
Splunk Employee
0 Karma

New Member

Nothing that would indicate why I'm unable to see all events, to me at least.

alt text

0 Karma

Splunk Employee
Splunk Employee

Is there a chance that some of the events in splunk don't have a value in the "name" field?
Is your search timeframe (4 hours) the same as the timeframe covered by the scan, i.e. same start and end time (and are the timezone settings the same?)?
What values do you get when you run sourcetype=nessus:scan | stats values(name)?

New Member

Is there a chance that some of the events in splunk don't have a value in the "name" field? I don't see how that's possible. Also if I do this search sourcetype=nessus:scan I get the same results so the name field can't be the issue.

Is your search timeframe (4 hours) the same as the timeframe covered by the scan, i.e. same start and end time (and are the timezone settings the same?)? Yes, the Nessus scan was run on 2/1 at 4:50 PM and completed in 38 minutes. You can see in the image above that my Splunk time frame is well within the Nessus time frame.

What values do you get when you run sourcetype=nessus:scan | stats values(name)? I ran my exact same search today and now I'm only getting 3 events. Maddening! I ran your search and got the same 3 events.
It's looking to me like the add-on is jacked up.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!