topic Re: Wrong parameters on macOS and logd input? in Getting Data In

Wrong parameters on macOS and logd input?

isoutamo — Fri, 18 Oct 2024 13:55:47 GMT

I try to Ingest macOS logd into Splunk Cloud. When I enable logd input it didn't work. Based on logs it use wrongly "log show" command.

log show --style ndjson --no-backtrace --no-debug --no-info --no-loss --no-signpost --predicate 'subsystem == "com.apple.TimeMachine" && eventMessage CONTAINS[c] "backup"' --start 2024-10-18 16:47:55 --end 2024-10-18 16:48:25

It should be

Have anyone noticed this and have anyone any fix for it or should I just create a support ticket?

r. Ismo

Re: Wrong parameters on macOS and logd input?

sainag_splunk — Sat, 19 Oct 2024 00:36:39 GMT

Hello @isoutamo missing double quotes parsing failing?

looks like a bug to me. We had an old similar type bug sometime back on Splunk version6 .

Re: Wrong parameters on macOS and logd input?

isoutamo — Sat, 19 Oct 2024 11:32:12 GMT

Thanx. I will create support case for this. Do you have old case id on your hands?

Re: Wrong parameters on macOS and logd input?

sainag_splunk — Sun, 20 Oct 2024 19:06:54 GMT

I found this old bug "SPL-109918" combined with a different issue though.

Thanks.

Re: Wrong parameters on macOS and logd input?

isoutamo — Sat, 02 Nov 2024 11:24:23 GMT

Case created.

Re: Wrong parameters on macOS and logd input?

Hod152 — Mon, 02 Dec 2024 21:54:54 GMT

Hey.
Any updates regarding the bug? Found the same issue, using latest splunk (9.3.2)

Re: Wrong parameters on macOS and logd input?

isoutamo — Mon, 02 Dec 2024 22:23:55 GMT

Not yet. I'm still discussing with support is this a bug or something else. Currently we are waiting (final?) answer from developers/PM to hear what are their plans for it.

Re: Wrong parameters on macOS and logd input?

Hod152 — Sun, 08 Dec 2024 09:27:23 GMT

Thanks,
Is there any temporary solution? older universal forwader version?
Collecting with script is blocked by Apple.

Re: Wrong parameters on macOS and logd input?

isoutamo — Sun, 08 Dec 2024 23:10:27 GMT

I think that using script should work. Just use sudo w/o password and with exact command if needed.
Splunk has recognized this as a bug, but I haven’t yet Jira either estimated fix version/time.

Re: Wrong parameters on macOS and logd input?

isoutamo — Mon, 23 Dec 2024 16:31:03 GMT

Fix for this will be SPL-266957.