topic Re: Symantec Endpoint Reporting App blank in Reporting

Symantec Endpoint Reporting App blank

frankhulcoop — Fri, 05 Jul 2013 18:16:52 GMT

Hi,

I've added the Symantec Endpoint Reporting App, but nothing is showing up in the dash.

I've setup logs to be transferred via UDP:515. If I search for data using sourcetype=sep11:log or source=udp:515 I can see all of the data so it's obviously going to splunk. Reading other questions, do I need to change the index? currently the index for the entries is showing as main. If I need to can someone guide me through it.

Im new to splunk so please be gentle.

Re: Symantec Endpoint Reporting App blank

bosburn_splunk — Mon, 08 Jul 2013 17:41:17 GMT

I actually suggest you install this app instead - http://splunk-base.splunk.com/apps/74435/splunk-for-symantec - Mine is outdated and hasn't been updated in a long time.

Brian

Re: Symantec Endpoint Reporting App blank

o_calmels — Thu, 18 Dec 2014 08:33:02 GMT

Hi, i have exactly the same problem, did you you solve it ?
I found that the sub-sourcetype defined in props.conf and transform.conf are not applied.
Any clue ?