Why is Splunk coming up in my system logs? I had never heard of it prior to this?

[chase_daniel]

I found these log messages in my system log on macOS High Sierra after a fresh install. Prior to this I had never heard of Splunk so this seems odd that information is being sent to Splunk. Can anyone explain this? Anti-virus software has preveiously found keyloggers and other spyware on my computers. The messages start either during the installation or immediatley after. To be clear I had never heard of Splunk before I saw these log messages recently.

2018-07-16 03:03:03.561239-0700 0x43f Default 0x0 128 0 mobileassetd: Syncing Splunk session info

2018-07-16 03:03:03.561533-0700 0x471 Default 0x0 128 0 mobileassetd: [com.apple.mobileassetd:Notice] -[DownloadManager syncSplunkTasks]_block_invoke_2: splunk session sync call back in progress

2018-07-16 03:03:03.561536-0700 0x471 Default 0x0 128 0 mobileassetd: [com.apple.mobileassetd:Notice] -[DownloadManager syncSplunkTasks]_block_invoke_2: Syncing splunk complete

2018-07-16 03:20:10.202139-0700 0x436c Default 0x11a40 678 0 identityservicesd: (FTServices) [com.apple.IDS:Registration] SplunkHint: SH:1:VEN-PROD:(deleted)

2018-07-16 03:20:10.966117-0700 0x436c Default 0x11a40 678 0 identityservicesd: (FTServices) [com.apple.IDS:Registration] SplunkHint: SH:1:VEN-PROD:(deleted)

2018-07-16 03:35:36.980057-0700 0x436c Default 0x0 678 0 identityservicesd: (FTServices) [com.apple.IDS:Registration] SplunkHint: (null)

2018-07-16 03:35:37.421807-0700 0x436c Default 0x0 678 0 identityservicesd: (FTServices) [com.apple.IDS:Registration] SplunkHint: SH:1:VEN-PROD:(deleted)

2018-07-16 03:35:37.758109-0700 0x436c Default 0x0 678 0 identityservicesd: (FTServices) [com.apple.IDS:Registration] SplunkHint: SH:1:VEN-PROD:(deleted)

2018-07-16 03:35:38.158736-0700 0x436c Default 0x0 678 0 identityservicesd: (FTServices) [com.apple.IDS:Registration] SplunkHint: SH:1:VEN-PROD:(deleted)

2018-07-17 11:19:37.066339-0700 0x20899 Default 0x0 2376 0 securityuploadd: [com.apple.securityd:upload] Splunk upload challenge for TrustTopic

2018-07-17 14:58:08.209481-0700 0x32f7c Default 0x0 2835 0 securityuploadd: [com.apple.securityd:upload] Splunk upload challenge for TrustTopic

2018-07-17 21:06:19.594937-0700 0x491 Default 0x0 175 0 mobileassetd: Syncing Splunk session info

2018-07-17 21:06:19.595647-0700 0x4db Default 0x0 175 0 mobileassetd: [com.apple.mobileassetd:Notice] -[DownloadManager syncSplunkTasks]_block_invoke_2: splunk session sync call back in progress

2018-07-17 21:06:19.595651-0700 0x4db Default 0x0 175 0 mobileassetd: [com.apple.mobileassetd:Notice] -[DownloadManager syncSplunkTasks]_block_invoke_2: Syncing splunk complete

[FrankVl]

Looks like Apple uses Splunk to collect certain events from customer systems. See also this discussion: https://discussions.apple.com/thread/8339138?answerId=8339138021#8339138021