Getting Data In

splunk and clamav logfile monitoring

splunknewby2021
Observer

I'm trying to configure Splunk to analyze logs coming from ClamAV.

I have a shared folder where the logs are coming in.

On the machine where the shared folder is located, I set the universalforwarder to monitor that folder with this command:

/opt/splunkforwarder/bin/splunk add monitor /shared/avlogs/ -index clamav -sourcetype clamav

Now it's happening that when I try to search

index="clamav" _raw="*FOUND*"

I don't get results everytime, but depends on the content of the logfile, like if the parsing was not done correctly. What am I missing?

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...