All Apps and Add-ons

TA-ClamAV App - Ingesting ClamAV data from sources other than the Syslog

barrydow
New Member

I'm interested in using the ClamAV App for Splunk and have installed it in my environment, but am so far not getting data ingested as expected. That said, I'm not that surprised at the issue as we aren't sending the clamscan results directly to the syslog, rather that data goes into dated files that are created in /var/log/clamav

So, I'm trying to figure out how to make the ClamAV app find those logs to use for the data that goes into that app's dashboard. Hopefully that all makes sense, but if not, if you folks bear with me, I'll explain and/or provide more information as necessary to hopefully get a solution to the issue and get this app working for my needs (and hopefully help educate others as well).

Thanks

0 Karma

ravichs1
Engager

can some share the screenshot of clamav app dashboards i have install the app .but no data i have a demo so i can to show the dashboards to them and explain what it can do.
Thanks in advance

0 Karma

pbalsley
Path Finder

To use the TA to monitor a file instead. you would add a [monitor] stanza for the file or directories you have:

http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/Data/Monitorfilesanddirectorieswithinputs.con...

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!