ClamAV 'Last Scanned' and 'Definition Date' not populating

[jcanoy24]

Good morning everyone, first time poster and very much a novice Splunk user.

My colleague is currently having an issue with our cyber team's dashboards not populating with ClamAV's Last Scanned and definition date properties. Currently, we're implementing  a temporary solution for having the definition dates populate properly, by manually setting the permissions to '644' on main.cvd, daily.cvd, and bytecode.cvd, and I think also for the database, via Ansible ad-hoc command. Is this something I can fix my modifying the inputs.conf file? If so, what properties would I need to add? 

For the 'Last Scanned' problem, Splunk simply shows up with 'Not Found'. I'm unsure of how to address this one, so any starters would be great.

I should add, this Splunk Enterprise instance is on an air-gapped environment. 

Thank you all in advance

[PickleRick]

More info please.

What are you trying to ingest and - most importantly - how. Are you using some particular add-on? Are you usign some scripted input of your own? What is your general setup? What version of the forwarder are you using?

[jcanoy24]

Trying to ingest the 'Last Scanned' and 'Definition Date' data from my remote hosts. Typically, we're running Universal Forwarder version 9.x installed in RHEL 8.x and 9.x systems. No scripted inputs are being utilized.

[PickleRick]

Yes. But those fields are parts of some events. What events are those? Where are they? (in log files? what log files?). How are you ingesting those files (your inputs definitions). What TAs are you using? Are you getting the data in your events but the fields are not being parsed correctly or are you not getting relevant events at all?