splunk and clamav logfile monitoring

Getting Data In

I'm trying to configure Splunk to analyze logs coming from ClamAV.

I have a shared folder where the logs are coming in.

On the machine where the shared folder is located, I set the universalforwarder to monitor that folder with this command:

/opt/splunkforwarder/bin/splunk add monitor /shared/avlogs/ -index clamav -sourcetype clamav

Now it's happening that when I try to search

index="clamav" _raw="*FOUND*"

I don't get results everytime, but depends on the content of the logfile, like if the parsing was not done correctly. What am I missing?

Get Updates on the Splunk Community!

At .conf24, we shared that we were in the process of integrating Cisco Talos threat intelligence into Splunk ...

The Splunk platform will transition to OpenSSL version 3 in a future release. Actions are required to prepare ...

Agent Saturation What and Whys In application performance monitoring, saturation is defined as the total load ...