Views:

There are two methods to collect Splunk debug logs:

  • Get raw logs from Linux server.

    cd /opt/splunk/var/log/splunk/
    sudo cat /opt/splunk/var/log/splunk/xdr_splunk_trendmicro_v1_observed_attack_techniques.log | tail -n 10sudo tail -f /opt/splunk/var/log/splunk/xdr_splunk_trendmicro_v1_observed_attack_techniques.log

    XDR Splunk log saved path: "/opt/splunk/var/log/splunk/xdr_splunk_*"

    Module state

    Module state

    App root path: cd /opt/splunk/etc/apps/xdr_splunk/

    Checkpoint data folder: cd /opt/splunk/etc/apps/xdr_splunk/data

    // status file name mapping
    {
      'wb': 'status-7a30d9b1a63aa0e9e48ba68fd128de222c30932d.json',
      'audit log': 'status-2fdf9e424a12cf53161ec320883dbd717334411e.json',
      'oat': 'status-2eb1d0f9f55d3c1456ad342f010fabcf0ffdc247.json'
    }
  • Get raw logs from Splunk Search Interface (recommended):
    1. Click into Splunk Search APP and perform the query.

      Module state

      As an example:

      Fetch OAT debug log: "index=_internal \[TrendMicro OAT\]"

      Module state

    2. You may set the time range.

      Module state

    3. To get Workbench debug log:

      "index=_internal \[TrendMicro XDR\]"

      To get Audit Log debug log:

      "index=_internal \[TrendMicro Audit\]"

      To get all debug and exception logs (also some unhandled error logs):

      "index=_internal sourcetype=xdr_splunk*"