Splunk Add-on for Symantec Endpoint Protection

rahul2gupta — Mon, 22 Jun 2020 06:16:21 GMT

When we used to run the following query index=symantec we would get the following result.

Till 29/08/2018 we were getting the results.

But now when we run the same query index=symantec it shows no results found

Below are our following findings/Actions.

Splunk forwarder was not installed we installed it.
We checked this path source = D:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\data\dump\scm_system.tmp but in dump file the file is empty there is nothing like sc_system.tmp
Sourcetype is also missing.

Please help me to fix this issue.

topic Splunk Add-on for Symantec Endpoint Protection in Getting Data In