Splunk Add on for Symantec Endpoint Protection

Getting Data In

Hi,

When we used to run the following query host=spd1agd01 we used to get events till 29/08/2018.

But when we the same query we don't get any results as it shows "no results found".

We checked on host spd1agd01 and found that splunk forwarder was not installed,we installed but although we are not getting the results.

We also checked at the following path: C:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\data\dump\scm_system.tmp but couldn't find anything .

Please help us to fix this issue.

@Anonymous

Get Updates on the Splunk Community!

Thanks for the Memories: .conf26 Took Learning to New Heights

Thank you, Splunk Community, for making .conf26 in Denver one for the books. From packed Splunk University ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...

Splunk Auto Ingestion Parallel Pipeline Scaling

Why this feature matters Many Splunk environments experience ingestion pressure long before the host is fully ...