We can't answer your questions without knowing what data you have indexed in Splunk. Obviously, if you don't have network traffic data then no query can help you. If you do have network traffic data then the exact query will depend on how the tool that reported that data chose to format it. See the Splunk Security Essentials app for examples.
I know of no way to determine which vulnerability scanner a remote site is using.
--- If this reply helps you, an upvote would be appreciated.