All Apps and Add-ons

Splunk Add-on for Symantec Endpoint Protection 2.0.1: Why can't I find SEP data on my Splunk Server?

aelzain
Engager

Hi,

I am new to Splunk and now am using using splunk 6.2 on Linux. A few days ago, I configured SEP to forward all Events (Client, System, Agents, etc.)

From the Splunk side, I've downloaded and added the Splunk Add-on for Symantec Endpoint Protection 2.0.1.

All network access are OK, and tested, but I don't know if the logs were sent from SEP or not or where and how to find it. I'm totally naive to SPLUNK. I have followed configuration steps, but I didn't find the logs on "$SEPM_HOME/data/dump"

0 Karma
1 Solution

jcoates_splunk
Splunk Employee
Splunk Employee

The list of possible problems is myriad... I'll assume it isn't sophons. Let's start with determining if it's a Splunk problem:

index=_internal

That search will show you all of Splunk's own logs. Most likely you'll see your own searches, your login to the system, and some housekeeping messages. Add "ERROR" to the search, and you'll see any problems.

If you don't see anything like "I am receiving your logs and throwing them on the floor because they're smelly", then it's probably not a Splunk problem. My guess is that you're trying to open a syslog port that the OS or its firewall isn't going to allow. Try using a port number over 1024 and allowing it through your firewall.

View solution in original post

0 Karma

jwalzerpitt
Influencer

On your SEP server, your logs should be in the following directory:

C:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\data\dump
0 Karma

jcoates_splunk
Splunk Employee
Splunk Employee

The list of possible problems is myriad... I'll assume it isn't sophons. Let's start with determining if it's a Splunk problem:

index=_internal

That search will show you all of Splunk's own logs. Most likely you'll see your own searches, your login to the system, and some housekeeping messages. Add "ERROR" to the search, and you'll see any problems.

If you don't see anything like "I am receiving your logs and throwing them on the floor because they're smelly", then it's probably not a Splunk problem. My guess is that you're trying to open a syslog port that the OS or its firewall isn't going to allow. Try using a port number over 1024 and allowing it through your firewall.

0 Karma
Get Updates on the Splunk Community!

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

SignalFlow: What? Why? How?

What is SignalFlow? Splunk Observability Cloud’s analytics engine, SignalFlow, opens up a world of in-depth ...

Federated Search for Amazon S3 | Key Use Cases to Streamline Compliance Workflows

Modern business operations are supported by data compliance. As regulations evolve, organizations must ...