Splunk Search

Splunk Query for Nessus vulnerabilities between firstSeen and lastSeen dates

alexj2323
New Member

I’m new to Splunk. I’m trying to come up with a search that would provide me with the number of Nessus vulnerability events related to a specific pluginID that falls between the firstSeen and the lastSeen dates (the dates are in epoch time). I understand this isn’t correct but I tried a lot of different combo’s and nothing seems to narrow the number of events down to the 18 (I should see)

Index=tenable sourcetype-tenable:sc:vuln adobe | spath pluginID | search pluginID=56213 | search firstSeen=1538883238 OR lastSeen=1555827242

Thanks

Tags (1)
0 Karma
1 Solution

spayneort
Contributor

How about this?

index=tenable sourcetype=tenable:sc:vuln pluginID=56213 firstSeen>1538883238 lastSeen<1555827242

View solution in original post

0 Karma

spayneort
Contributor

How about this?

index=tenable sourcetype=tenable:sc:vuln pluginID=56213 firstSeen>1538883238 lastSeen<1555827242
0 Karma

alexj2323
New Member

Thanks for the assistance...

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...