splunk and clamav logfile monitoring

Getting Data In

I'm trying to configure Splunk to analyze logs coming from ClamAV.

I have a shared folder where the logs are coming in.

On the machine where the shared folder is located, I set the universalforwarder to monitor that folder with this command:

/opt/splunkforwarder/bin/splunk add monitor /shared/avlogs/ -index clamav -sourcetype clamav

Now it's happening that when I try to search

index="clamav" _raw="*FOUND*"

I don't get results everytime, but depends on the content of the logfile, like if the parsing was not done correctly. What am I missing?

Get Updates on the Splunk Community!

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious! We’re back with another ...