Getting Data In

Splunk Add-on for Symantec Endpoint Protection

rahul2gupta
Path Finder

Hi 

When  we used to run the following query index=symantec we would get the following result.

Till 29/08/2018 we were getting the results.

But now when we run the same query index=symantec it shows no results found

Below are our following findings/Actions.

  • Splunk forwarder was not installed we installed it.
  • We checked this path  source = D:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\data\dump\scm_system.tmp but in dump file the file is empty there is nothing like sc_system.tmp
  • Sourcetype is also missing.

Please help me to fix this issue.

Labels (2)
Tags (1)
0 Karma
Get Updates on the Splunk Community!

Get Operational Insights Quickly with Natural Language on the Splunk Platform

In today’s fast-paced digital world, turning data into actionable insights is essential for success. With ...

What’s New in Splunk Observability Cloud – June 2025

What’s New in Splunk Observability Cloud – June 2025 We are excited to announce the latest enhancements to ...

Almost Too Eventful Assurance: Part 2

Work While You SleepBefore you can rely on any autonomous remediation measures, you need to close the loop ...