TA-ClamAV App - Ingesting ClamAV data from sources other than the Syslog

[barrydow]

I'm interested in using the ClamAV App for Splunk and have installed it in my environment, but am so far not getting data ingested as expected. That said, I'm not that surprised at the issue as we aren't sending the clamscan results directly to the syslog, rather that data goes into dated files that are created in /var/log/clamav

So, I'm trying to figure out how to make the ClamAV app find those logs to use for the data that goes into that app's dashboard. Hopefully that all makes sense, but if not, if you folks bear with me, I'll explain and/or provide more information as necessary to hopefully get a solution to the issue and get this app working for my needs (and hopefully help educate others as well).

Thanks

[ravichs1]

can some share the screenshot of clamav app dashboards i have install the app .but no data i have a demo so i can to show the dashboards to them and explain what it can do.
Thanks in advance

[pbalsley]

To use the TA to monitor a file instead. you would add a [monitor] stanza for the file or directories you have:

http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/Data/Monitorfilesanddirectorieswithinputs.con...