Splunk Search

how to retrive data from symantec end point protection

New Member


Does any one know how to get data from symantec endpoint protection server, so the "Symantec Endpoint Protection Reporting" app will work?

Best regards & Thanks, John.

Tags (1)
0 Karma

Path Finder

From the SEP management console, click on Admin, then select Local Site. You should then see an option for Configure External Logging. From the Configure External Logging option you should be able specify a syslog server or send directly to your Splunk server.


Did you set it up to send it to the splunk machine itself or just a flat file?

I found it easier to set up Splunk to listen on a port (I used 42096) and configure Symantec to talk to the server (in my case, plsplunk01:42096).


0 Karma

New Member

great that worked now files are created ,
now i need to get splunk to read them (they are not on the same machine),
Any one?

0 Karma


Hi, you ve got two solutions :
- Tell SEPM to send logs to syslog server, this server being your splunk instance (be carefull if your instance is distributed and you are using universal forwarder, the sourtype association will no work properly because universal forwarder doesn't modify any data, it just forward to indexers.)
- So the second solution is to install a universal fowarder on your SEPM server directly, install the Splunk For Symantec TA on it and configure the props.conf to match each file created by SEPM.


0 Karma
Get Updates on the Splunk Community!

Streamline Data Ingestion With Deployment Server Essentials

REGISTER NOW!Every day the list of sources Admins are responsible for gets bigger and bigger, often making the ...

Remediate Threats Faster and Simplify Investigations With Splunk Enterprise Security ...

REGISTER NOW!Join us for a Tech Talk around our latest release of Splunk Enterprise Security 7.2! We’ll walk ...

Introduction to Splunk AI

WATCH NOWHow are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. ...