Dashboards & Visualizations

Splunk Integration with ATP (EDR) logs


Hi All,
Currently, we are facing issue while integrating the Symantec EDR (ATP) logs to Splunk.
I tried to refer the Splunk Add-on for EDR (https://splunkbase.splunk.com/app/3454/) and Splunk App for EDR (https://splunkbase.splunk.com/app/3453). But, these Apps and add-ons are no more supported by Splunk.

We were referring the Symantec Splunk connector Integration document and followed the steps as per the document. (https://support.symantec.com/us/en/article.doc11188.html)

  • Created a new HEC Token and enabled the token.
  • On the Symantec connector side, we configured this token and when we tested it, it displays a message as:

"Splunk telemetry notification sent : [SPLUNK_UPLOAD_FAILURE: cause=Splunk event upload failed. Http code [403], reason [Exception occurred while parsing response]" due to which we are unable to send the logs to Splunk

They are getting a token error on Symantec connector though I confirmed that we are using the same connector that was created on Splunk Heavy Forwarder. We performed this steps multiple times but no luck.

Kindly check the issue and guide us. regards, Santosh

0 Karma


Hi Santosh,

Were you able to solve this problem.



0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!