Getting Data In

Wrong parameters on macOS and logd input?

isoutamo
SplunkTrust
SplunkTrust

Hi

I try to Ingest macOS logd into Splunk Cloud. When I enable logd input it didn't work. Based on logs it use wrongly "log show" command.

 

log show --style ndjson --no-backtrace --no-debug --no-info --no-loss --no-signpost --predicate 'subsystem == "com.apple.TimeMachine" && eventMessage CONTAINS[c] "backup"' --start 2024-10-18 16:47:55 --end 2024-10-18 16:48:25

 

It should be

 

log show --style ndjson --no-backtrace --no-debug --no-info --no-loss --no-signpost --predicate 'subsystem == "com.apple.TimeMachine" && eventMessage CONTAINS[c] "backup"' --start "2024-10-18 16:47:55" --end "2024-10-18 16:48:25"

 

Have anyone noticed this and have anyone any fix for it or should I just create a support ticket?

r. Ismo

Labels (3)
0 Karma

sainag_splunk
Splunk Employee
Splunk Employee

Hello @isoutamo missing double quotes parsing failing?


looks like a bug to me. We had an old similar type bug sometime back on Splunk version6 .

isoutamo
SplunkTrust
SplunkTrust

Thanx. I will create support case for this. Do you have old case id on your hands?

sainag_splunk
Splunk Employee
Splunk Employee

I found this old bug "SPL-109918"  combined with a different issue though. 

Thanks.

 
 
 
0 Karma

isoutamo
SplunkTrust
SplunkTrust
Case created.
0 Karma

Hod152
Explorer

Hey.
Any updates regarding the bug? Found the same issue, using latest splunk (9.3.2)

0 Karma

isoutamo
SplunkTrust
SplunkTrust
Not yet. I'm still discussing with support is this a bug or something else. Currently we are waiting (final?) answer from developers/PM to hear what are their plans for it.
0 Karma

isoutamo
SplunkTrust
SplunkTrust
Fix for this will be SPL-266957.
0 Karma

Hod152
Explorer

Thanks,
Is there any temporary solution? older universal forwader version?
Collecting with script is blocked by Apple. 

0 Karma

isoutamo
SplunkTrust
SplunkTrust
I think that using script should work. Just use sudo w/o password and with exact command if needed.
Splunk has recognized this as a bug, but I haven’t yet Jira either estimated fix version/time.
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...