We have data coming into the Tenable Add-on for Security Center. However, it seems that not ALL of the data is there. The polling is 86400, once a day.
At this point we are just trying to validate what we see in Splunk matches what we see in Tenable. We are using the Vulnerailbity Analysis module in tenable.sc which gives us one number. The we run index=tenable | stats dc(ip) for All Time; but we get a completely different number, The unique count is 10's of thousands fewer than what Tenable is reporting.
We are using the filters on pluginID, IP address, etc in Tenable and also in Splunk.
How can we reconcile what we see in Splunk compared to what we see in Tenable for counts?