thank you. ... View more

Thank you. ... View more

https://splunkbase.splunk.com/app/2772/ this is for SEP not SPE. https://www.symantec.com/connect/groups/symantec-apps-splunk I dont see SPE in this. So i guess Splunk forwarder is how i should proceed. I will look into it. Thanks. ... View more

QRadar has the ability to gather logs from sources (like SPE). I believe its using API. Is there something similar for Splunk? ... View more

How about pulling the logs from Splunk instead of sending them from SPE using a third party tool? I know it is possible using QRadar, not sure how it works on Splunk. Any thoughts there? ... View more

Thanks Rich. I did look at the doc, it basically says use rsyslog and forward it to Splunk. I cannot afford a new machine for this. So i guess theres no splunk agent for this and i should use rsyslog or some other log forwarded. ... View more