All Apps and Add-ons

Timestamp not working on Nessus addon

markusswanepoel
Engager

Hi, I'm quite new to Splunk.

I have imported a few Nesses files into Splunk using the addon, however the start_time and end_time fields are not converted to timestamp fields as per the config (eventgen.conf)file.

The timestamp field shows "none" and the start/end_time fields are considered as strings.
I have tested the regular expression in the default file, and it matches.

Please assist.
Thanks

0 Karma
1 Solution

markusswanepoel
Engager

Update:

I have found a solution, you have to uncomment the following lines in the
/opt/splunk/etc/apps/Splunk_TA_nessus/default/props.conf file.

DATETIME_CONFIG =

TIME_PREFIX = end_time="

TIME_FORMAT = %a %b %d %H:%M:%S %Y

The data is now time searchable. I feel this should've been in the documentation.

View solution in original post

markusswanepoel
Engager

Update:

I have found a solution, you have to uncomment the following lines in the
/opt/splunk/etc/apps/Splunk_TA_nessus/default/props.conf file.

DATETIME_CONFIG =

TIME_PREFIX = end_time="

TIME_FORMAT = %a %b %d %H:%M:%S %Y

The data is now time searchable. I feel this should've been in the documentation.

View solution in original post

Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!