topic Re: ClamAV 'Last Scanned' and 'Definition Date' not populating in Getting Data In

ClamAV 'Last Scanned' and 'Definition Date' not populating

jcanoy24 — Mon, 29 Jun 2026 14:10:16 GMT

Good morning everyone, first time poster and very much a novice Splunk user.

My colleague is currently having an issue with our cyber team's dashboards not populating with ClamAV's Last Scanned and definition date properties. Currently, we're implementing a temporary solution for having the definition dates populate properly, by manually setting the permissions to '644' on main.cvd, daily.cvd, and bytecode.cvd, and I think also for the database, via Ansible ad-hoc command. Is this something I can fix my modifying the inputs.conf file? If so, what properties would I need to add?

For the 'Last Scanned' problem, Splunk simply shows up with 'Not Found'. I'm unsure of how to address this one, so any starters would be great.

I should add, this Splunk Enterprise instance is on an air-gapped environment.

Thank you all in advance

Re: ClamAV 'Last Scanned' and 'Definition Date' not populating

PickleRick — Tue, 30 Jun 2026 17:47:57 GMT

More info please.

What are you trying to ingest and - most importantly - how. Are you using some particular add-on? Are you usign some scripted input of your own? What is your general setup? What version of the forwarder are you using?

Re: ClamAV 'Last Scanned' and 'Definition Date' not populating

jcanoy24 — Tue, 07 Jul 2026 16:12:09 GMT

Trying to ingest the 'Last Scanned' and 'Definition Date' data from my remote hosts. Typically, we're running Universal Forwarder version 9.x installed in RHEL 8.x and 9.x systems. No scripted inputs are being utilized.

Re: ClamAV 'Last Scanned' and 'Definition Date' not populating

PickleRick — Wed, 08 Jul 2026 07:21:42 GMT

Yes. But those fields are parts of some events. What events are those? Where are they? (in log files? what log files?). How are you ingesting those files (your inputs definitions). What TAs are you using? Are you getting the data in your events but the fields are not being parsed correctly or are you not getting relevant events at all?