Diff Nessus Reports

[leunammejii]

I'm trying to compare two monthly Nessus reports using Splunk with the following command:

sourcetype="nessus:scan" name=REPORT_NAME earliest=-1mon@mon latest=@mon NOT severity=informational NOT [search sourcetype="nessus:scan" name=REPORT_NAME earliest=-2mon@mon latest=-1mon@mon NOT severity=informational | dedup plugin_id,host-fqdn | table host-fqdn,name,operating-system,plugin_id,plugin_name,policy,severity,severity_index] | dedup plugin_id,host-fqdn | table host-fqdn,name,operating-system,plugin_id,plugin_name,policy,severity,severity_index | stats count by severity

I get results but I get them almost 15 minutes later. The search head has the recommended resources but it is still slow as a snail. What am I doing wrong?

I've also tried the following but it only compares the first event:

[search sourcetype="nessus:scan" name=REPORT_NAME earliest=-1mon@mon latest=@mon NOT severity=informational | dedup plugin_id,host-fqdn | table host-fqdn,name,operating-system,plugin_id,plugin_name,policy,severity,severity_index] [search sourcetype="nessus:scan" name=REPORT_NAME earliest=-2mon@mon latest=-1mon@mon NOT severity=informational | dedup plugin_id,host-fqdn | table host-fqdn,name,operating-system,plugin_id,plugin_name,policy,severity,severity_index] | diff maxlen=0

[sundareshr]

See if this helps

sourcetype="nessus:scan" name=REPORT_NAME NOT (severity=informational) earliest=-2mon@mon  | eval when=if(_time>relative_time(now(), "-1mon@mon"), "Current", "Previous") | eval h=host-fqdn."#".name | chart count over h by when | rex field=h "(?<host-fqdn>[^#]+)#(?<name>.*)" | fields - h