We are sending McAfee logs from ePO DB using the documentation provided with the TA and DB connect (since 1 year)
http://docs.splunk.com/Documentation/AddOns/released/McAfeeEPO/ConfigureDBConnectv2inputs
But we notice that only the old mcafee client (Virus Scan) has correct logs in splunk, when it is the current client (EndPoint Security), data in splunk are not useful because crucial fields like file_name is empty (it is the file name of the threat)
From ePo console we can see that is it now Target Path + Target Name but not present.
... View more