Getting Data In

Wrong parameters on macOS and logd input?

isoutamo
SplunkTrust
SplunkTrust

Hi

I try to Ingest macOS logd into Splunk Cloud. When I enable logd input it didn't work. Based on logs it use wrongly "log show" command.

 

log show --style ndjson --no-backtrace --no-debug --no-info --no-loss --no-signpost --predicate 'subsystem == "com.apple.TimeMachine" && eventMessage CONTAINS[c] "backup"' --start 2024-10-18 16:47:55 --end 2024-10-18 16:48:25

 

It should be

 

log show --style ndjson --no-backtrace --no-debug --no-info --no-loss --no-signpost --predicate 'subsystem == "com.apple.TimeMachine" && eventMessage CONTAINS[c] "backup"' --start "2024-10-18 16:47:55" --end "2024-10-18 16:48:25"

 

Have anyone noticed this and have anyone any fix for it or should I just create a support ticket?

r. Ismo

Labels (3)
0 Karma

sainag_splunk
Splunk Employee
Splunk Employee

Hello @isoutamo missing double quotes parsing failing?


looks like a bug to me. We had an old similar type bug sometime back on Splunk version6 .

isoutamo
SplunkTrust
SplunkTrust

Thanx. I will create support case for this. Do you have old case id on your hands?

sainag_splunk
Splunk Employee
Splunk Employee

I found this old bug "SPL-109918"  combined with a different issue though. 

Thanks.

 
 
 
0 Karma

isoutamo
SplunkTrust
SplunkTrust
Case created.
0 Karma

Hod152
Explorer

Hey.
Any updates regarding the bug? Found the same issue, using latest splunk (9.3.2)

0 Karma

isoutamo
SplunkTrust
SplunkTrust
Not yet. I'm still discussing with support is this a bug or something else. Currently we are waiting (final?) answer from developers/PM to hear what are their plans for it.
0 Karma

isoutamo
SplunkTrust
SplunkTrust
Fix for this will be SPL-266957.
0 Karma

Hod152
Explorer

Thanks,
Is there any temporary solution? older universal forwader version?
Collecting with script is blocked by Apple. 

0 Karma

isoutamo
SplunkTrust
SplunkTrust
I think that using script should work. Just use sudo w/o password and with exact command if needed.
Splunk has recognized this as a bug, but I haven’t yet Jira either estimated fix version/time.
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...