Splunk Add-on for Symantec Endpoint Protection 2.0.1: Why can't I find SEP data on my Splunk Server?

[aelzain]

Hi,

I am new to Splunk and now am using using splunk 6.2 on Linux. A few days ago, I configured SEP to forward all Events (Client, System, Agents, etc.)

From the Splunk side, I've downloaded and added the Splunk Add-on for Symantec Endpoint Protection 2.0.1.

All network access are OK, and tested, but I don't know if the logs were sent from SEP or not or where and how to find it. I'm totally naive to SPLUNK. I have followed configuration steps, but I didn't find the logs on "$SEPM_HOME/data/dump"

[jwalzerpitt]

On your SEP server, your logs should be in the following directory:

C:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\data\dump

[jcoates_splunk · Accepted solution]

The list of possible problems is myriad... I'll assume it isn't sophons. Let's start with determining if it's a Splunk problem:

index=_internal

That search will show you all of Splunk's own logs. Most likely you'll see your own searches, your login to the system, and some housekeeping messages. Add "ERROR" to the search, and you'll see any problems.

If you don't see anything like "I am receiving your logs and throwing them on the floor because they're smelly", then it's probably not a Splunk problem. My guess is that you're trying to open a syslog port that the OS or its firewall isn't going to allow. Try using a port number over 1024 and allowing it through your firewall.