Splunk Add on for Symantec Endpoint Protection

Getting Data In

Hi,

When we used to run the following query host=spd1agd01 we used to get events till 29/08/2018.

But when we the same query we don't get any results as it shows "no results found".

We checked on host spd1agd01 and found that splunk forwarder was not installed,we installed but although we are not getting the results.

We also checked at the following path: C:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\data\dump\scm_system.tmp but couldn't find anything .

Please help us to fix this issue.

@Anonymous

Get Updates on the Splunk Community!

Your Feedback. Our Roadmap. Visit the PX Feedback Booth at .conf26

You use Splunk every day, come and help shape what's next. Save Your Seat: Product-Focused Sessions at ...

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

The Problem: Too Many Alerts, Too Little Context Security operations teams running Splunk Enterprise Security ...

Painting a Clearer Picture: Creating Cross-Domain Visibility with AI Canvas

Watch Now Painting a Clearer Picture: Creating Cross-Domain Visibility with AI Canvas Do you ever feel ...