Splunk Query for Nessus vulnerabilities between firstSeen and lastSeen dates

[alexj2323]

I’m new to Splunk. I’m trying to come up with a search that would provide me with the number of Nessus vulnerability events related to a specific pluginID that falls between the firstSeen and the lastSeen dates (the dates are in epoch time). I understand this isn’t correct but I tried a lot of different combo’s and nothing seems to narrow the number of events down to the 18 (I should see)

Index=tenable sourcetype-tenable:sc:vuln adobe | spath pluginID | search pluginID=56213 | search firstSeen=1538883238 OR lastSeen=1555827242

Thanks

[spayneort · Accepted solution]

How about this?

index=tenable sourcetype=tenable:sc:vuln pluginID=56213 firstSeen>1538883238 lastSeen<1555827242

[alexj2323]

Thanks for the assistance...