Getting Data In

Splunk Add-on for Symantec Endpoint Protection

rahul2gupta
Path Finder

Hi 

When  we used to run the following query index=symantec we would get the following result.

Till 29/08/2018 we were getting the results.

But now when we run the same query index=symantec it shows no results found

Below are our following findings/Actions.

  • Splunk forwarder was not installed we installed it.
  • We checked this path  source = D:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\data\dump\scm_system.tmp but in dump file the file is empty there is nothing like sc_system.tmp
  • Sourcetype is also missing.

Please help me to fix this issue.

Labels (2)
Tags (1)
0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...

Major Splunk Upgrade – Prepare your Environment for Splunk 10 Now!

Attention App Developers: Test Your Apps with the Splunk 10.0 Beta and Ensure Compatibility Before the ...

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...