Sending MacOS logs to Splunk without involving another tool or agent

[brattyah]

Trying to figure out a successful method for sending MacOS logs to Splunk without involving another tool or agent. We have the Splunk UF installed on the Mac and the Splunk_TA_nix app which pulls some data but not all from the Mac. However, most of the logging broke a few years ago when Apple changed over to the Unified Log database format. Any guidance or suggestions on best practices would be much appreciated!

[richgalloway]

Apple's new log format is binary so Splunk will not index it, even if it could read it. The only way I've found to ingest Mac logs is with a third-party tool like Jamf.

[esix_splunk]

Ill second that statement. JAMF seems to be the most common, and easiest way to manage a fleet of Max OS based laptops. I've yet to see other notable (read that as useful) endpoint management for Macs, but I digress.

JAMF can be pulled into Splunk. These are pushed out of JAMF in xml format and easy to deal with on the Splunk side. Check out Splunkbase for existing TA's that can help pull this from the JAMF APIs.