We need a lot more information before we can help.
When did this start? What changed around that time (Splunk, Tenable, firewalls)? Have you checked splunkd.log?
What is the path for Tenable data to get into Splunk (UF, HF, etc.)? Have you verified all instances in the path are up?
---
If this reply helps you, Karma would be appreciated.
