Getting Data In

Sending MacOS logs to Splunk without involving another tool or agent

brattyah
Splunk Employee
Splunk Employee

Trying to figure out a successful method for sending MacOS logs to Splunk without involving another tool or agent. We have the Splunk UF installed on the Mac and the Splunk_TA_nix app which pulls some data but not all from the Mac. However, most of the logging broke a few years ago when Apple changed over to the Unified Log database format. Any guidance or suggestions on best practices would be much appreciated!

Labels (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust
Apple's new log format is binary so Splunk will not index it, even if it could read it. The only way I've found to ingest Mac logs is with a third-party tool like Jamf.
---
If this reply helps you, Karma would be appreciated.

esix_splunk
Splunk Employee
Splunk Employee

Ill second that statement. JAMF seems to be the most common, and easiest way to manage a fleet of Max OS based laptops. I've yet to see other notable (read that as useful) endpoint management for Macs, but I digress.

JAMF can be pulled into Splunk. These are pushed out of JAMF in xml format and easy to deal with on the Splunk side. Check out Splunkbase for existing TA's that can help pull this from the JAMF APIs.

 

 

 

Get Updates on the Splunk Community!

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...

Adoption of Infrastructure Monitoring at Splunk

  Splunk's Growth Engineering team showcases one of their first Splunk product adoption-Splunk Infrastructure ...

Modern way of developing distributed application using OTel

Recently, I had the opportunity to work on a complex microservice using Spring boot and Quarkus to develop a ...