<54>Nov 30 15:02:42 SymantecServer SR-SAAP-SEP01: Scan ID: 1448882755,Begin: 2015-11-30 11:47:09,End: 2015-11-30 11:58:44,Completed,Duration (seconds): 695,User1: SYSTEM,User2: SYSTEM,'Scan started on selected drives and folders and all extensions.','Scan Complete: Risks: 0 Scanned: 1472 Files/Folders/Drives Omitted: 0 Trusted Files Skipped: 1465',Command: Not a command scan (),Threats: 0,Infected: 0,Total files: 1472,Omitted: 0,Computer: IBV-HQ-L12,IP Address: 172.18.10.34,Domain: Default,"Group: My Company\Workstations\Information Technology\",Server: SR-SAAP-SEP01 <54>Nov 30 15:00:42 SymantecServer SR-SAAP-SEP01: Scan ID: 1448884513,Begin: 2015-11-30 11:55:45,End: ,Started,Duration (seconds): 0,User1: z.Zomoniem,User2: ,'Scan started on selected drives and folders and all extensions.',,Command: Not a command scan (),Threats: 0,Infected: 0,Total files: 0,Omitted: 0,Computer: MLK-HQ-324,IP Address: 172.18.3.65,Domain: Default,Group: My Company\Workstations,Server: SR-SAAP-SEP01 am trying to create different types of reports that showing the the threat that I may face from viruses and not up to date machines, but the issue is that the event locks mess rather than that am not familiar with rex and regex commands and syntax. ... View more

Hi, I am new to Splunk and now am using using splunk 6.2 on Linux. A few days ago, I configured SEP to forward all Events (Client, System, Agents, etc.) From the Splunk side, I've downloaded and added the Splunk Add-on for Symantec Endpoint Protection 2.0.1. All network access are OK, and tested, but I don't know if the logs were sent from SEP or not or where and how to find it. I'm totally naive to SPLUNK. I have followed configuration steps, but I didn't find the logs on "$SEPM_HOME/data/dump" ... View more