All Apps and Add-ons

Splunk Add-on for Symantec Endpoint Protection 2.0.1: Why can't I find SEP data on my Splunk Server?

aelzain
Engager

Hi,

I am new to Splunk and now am using using splunk 6.2 on Linux. A few days ago, I configured SEP to forward all Events (Client, System, Agents, etc.)

From the Splunk side, I've downloaded and added the Splunk Add-on for Symantec Endpoint Protection 2.0.1.

All network access are OK, and tested, but I don't know if the logs were sent from SEP or not or where and how to find it. I'm totally naive to SPLUNK. I have followed configuration steps, but I didn't find the logs on "$SEPM_HOME/data/dump"

0 Karma
1 Solution

jcoates_splunk
Splunk Employee
Splunk Employee

The list of possible problems is myriad... I'll assume it isn't sophons. Let's start with determining if it's a Splunk problem:

index=_internal

That search will show you all of Splunk's own logs. Most likely you'll see your own searches, your login to the system, and some housekeeping messages. Add "ERROR" to the search, and you'll see any problems.

If you don't see anything like "I am receiving your logs and throwing them on the floor because they're smelly", then it's probably not a Splunk problem. My guess is that you're trying to open a syslog port that the OS or its firewall isn't going to allow. Try using a port number over 1024 and allowing it through your firewall.

View solution in original post

0 Karma

jwalzerpitt
Motivator

On your SEP server, your logs should be in the following directory:

C:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\data\dump
0 Karma

jcoates_splunk
Splunk Employee
Splunk Employee

The list of possible problems is myriad... I'll assume it isn't sophons. Let's start with determining if it's a Splunk problem:

index=_internal

That search will show you all of Splunk's own logs. Most likely you'll see your own searches, your login to the system, and some housekeeping messages. Add "ERROR" to the search, and you'll see any problems.

If you don't see anything like "I am receiving your logs and throwing them on the floor because they're smelly", then it's probably not a Splunk problem. My guess is that you're trying to open a syslog port that the OS or its firewall isn't going to allow. Try using a port number over 1024 and allowing it through your firewall.

View solution in original post

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!