All Apps and Add-ons

Splunk for Symantec field extraction issue


I noticed that some fields within the Splunk for Symantec sourcetype=symantec:ep:security:file is not being properly extracted. For example, the Applications_Name field has time values:

2017-11-14 21:28:57
2017-11-14 21:31:29

begin_Time has protocol values:


as well as some other fields with values that aren't matching up. Anyone else having this issue?


0 Karma


I do not believe these are fields that come with this app; they do not exist on my deployment, nor was I able to find "Applications_Name" anywhere in my servers.

I suspect these fields may have been locally grown, I suggest looking up their attributes/owner under field settings.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!