Wrong parameters on macOS and logd input?

[isoutamo]

Hi

I try to Ingest macOS logd into Splunk Cloud. When I enable logd input it didn't work. Based on logs it use wrongly "log show" command.

log show --style ndjson --no-backtrace --no-debug --no-info --no-loss --no-signpost --predicate 'subsystem == "com.apple.TimeMachine" && eventMessage CONTAINS[c] "backup"' --start 2024-10-18 16:47:55 --end 2024-10-18 16:48:25

It should be

log show --style ndjson --no-backtrace --no-debug --no-info --no-loss --no-signpost --predicate 'subsystem == "com.apple.TimeMachine" && eventMessage CONTAINS[c] "backup"' --start "2024-10-18 16:47:55" --end "2024-10-18 16:48:25"

Have anyone noticed this and have anyone any fix for it or should I just create a support ticket?

r. Ismo

[sainag_splunk]

Hello @isoutamo missing double quotes parsing failing?

looks like a bug to me. We had an old similar type bug sometime back on Splunk version6 .

[isoutamo]

Thanx. I will create support case for this. Do you have old case id on your hands?

[sainag_splunk]

I found this old bug "SPL-109918"  combined with a different issue though. 

Thanks.

[isoutamo]

Case created.

[Hod152]

Hey.
Any updates regarding the bug? Found the same issue, using latest splunk (9.3.2)

[isoutamo]

Not yet. I'm still discussing with support is this a bug or something else. Currently we are waiting (final?) answer from developers/PM to hear what are their plans for it.

[isoutamo]

Fix for this will be SPL-266957.

[Hod152]

Thanks,
Is there any temporary solution? older universal forwader version?
Collecting with script is blocked by Apple. 

[isoutamo]

I think that using script should work. Just use sudo w/o password and with exact command if needed.
Splunk has recognized this as a bug, but I haven’t yet Jira either estimated fix version/time.