Splunk Search

How do I filter tenable scan results by lastSeen value?

lball
Explorer

I'm trying to filter my Tenable results to show only vulnerabilities seen within the last 7 days. Here is my current search:

index=tenable (riskFactor=Critical OR riskFactor=High OR riskFactor=Medium OR riskFactor=Low) earliest=-2d 
| where lastSeen < relative_time(now(),"-7d")
| eval LastSeen=strftime(lastSeen,"%Y-%m-%d")
| stats count by ip,riskFactor,pluginName,dnsName,solution,scan_result_info.name,LastSeen 
| stats list(pluginName) list(solution) list(LastSeen) list(riskFactor) list(count) sum(count) by scan_result_info.name,ip,dnsName 
| sort -sum(count)

If I remove the

| where lastSeen < relative_time(now(),"-7d")

then I get results. By default the lastSeen values are in epoch time format.

0 Karma
1 Solution

somesoni2
Revered Legend

If you're looking for vulnerabilities received within last 7 days, shouldn't your where clause be | where lastSeen >= relative_time(now(),"-7d")??

View solution in original post

0 Karma

somesoni2
Revered Legend

If you're looking for vulnerabilities received within last 7 days, shouldn't your where clause be | where lastSeen >= relative_time(now(),"-7d")??

0 Karma

lball
Explorer

That did the trick! Thank you!

0 Karma

somesoni2
Revered Legend

Great. Don't forget to close the question for accepting this as an answer. This will help any splunker with similar problem to know that the solution worked.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...