Getting Data In

Wrong parameters on macOS and logd input?

isoutamo
SplunkTrust
SplunkTrust

Hi

I try to Ingest macOS logd into Splunk Cloud. When I enable logd input it didn't work. Based on logs it use wrongly "log show" command.

 

log show --style ndjson --no-backtrace --no-debug --no-info --no-loss --no-signpost --predicate 'subsystem == "com.apple.TimeMachine" && eventMessage CONTAINS[c] "backup"' --start 2024-10-18 16:47:55 --end 2024-10-18 16:48:25

 

It should be

 

log show --style ndjson --no-backtrace --no-debug --no-info --no-loss --no-signpost --predicate 'subsystem == "com.apple.TimeMachine" && eventMessage CONTAINS[c] "backup"' --start "2024-10-18 16:47:55" --end "2024-10-18 16:48:25"

 

Have anyone noticed this and have anyone any fix for it or should I just create a support ticket?

r. Ismo

Labels (3)
0 Karma

sainag_splunk
Splunk Employee
Splunk Employee

Hello @isoutamo missing double quotes parsing failing?


looks like a bug to me. We had an old similar type bug sometime back on Splunk version6 .

isoutamo
SplunkTrust
SplunkTrust

Thanx. I will create support case for this. Do you have old case id on your hands?

sainag_splunk
Splunk Employee
Splunk Employee

I found this old bug "SPL-109918"  combined with a different issue though. 

Thanks.

 
 
 
0 Karma

isoutamo
SplunkTrust
SplunkTrust
Case created.
0 Karma

Hod152
Explorer

Hey.
Any updates regarding the bug? Found the same issue, using latest splunk (9.3.2)

0 Karma

isoutamo
SplunkTrust
SplunkTrust
Not yet. I'm still discussing with support is this a bug or something else. Currently we are waiting (final?) answer from developers/PM to hear what are their plans for it.
0 Karma

isoutamo
SplunkTrust
SplunkTrust
Fix for this will be SPL-266957.
0 Karma

Hod152
Explorer

Thanks,
Is there any temporary solution? older universal forwader version?
Collecting with script is blocked by Apple. 

0 Karma

isoutamo
SplunkTrust
SplunkTrust
I think that using script should work. Just use sudo w/o password and with exact command if needed.
Splunk has recognized this as a bug, but I haven’t yet Jira either estimated fix version/time.
0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...