topic Why is the Splunk Add-on for Bro IDS not automatically extracting the fields? in All Apps and Add-ons

Why is the Splunk Add-on for Bro IDS not automatically extracting the fields?

cdupuis123 — Mon, 28 Sep 2020 19:24:59 GMT

example bro_notice fields go ts (tab) uid (tab) id.orig_h (tab) etc etc splunk is like ignoring these????? Do I need to manually recreate all the fields????

Re: Why is the Splunk Add-on for Bro IDS not automatically extracting the fields?

jcoates_splunk — Sat, 11 Apr 2015 21:37:47 GMT

It is supposed to parse the fields, and it continues to do so in our automated tests and demo environments. I don't know what you're doing differently. You could file a ticket, since it's a supported app, or follow the troubleshooting tips at http://docs.splunk.com/Documentation/AddOns/released/Overview/Troubleshootadd-ons

Re: Why is the Splunk Add-on for Bro IDS not automatically extracting the fields?

reesb — Tue, 10 May 2016 13:56:40 GMT

I have exactly the same issue with bro running on linux with a universal forwarder (6.4.0) sending data to an indexer running Splunk Enterprise (also 6.4.0) and the latest bro addon(3.2.0).

Is there a fix planned?

Re: Why is the Splunk Add-on for Bro IDS not automatically extracting the fields?

alexlomas — Wed, 01 Jun 2016 16:28:26 GMT

I have a similar issue. I have a search head and separate indexer; there is a universal forwarder sending the Bro log files to the indexer (I'm not bothering with the PCAP stuff for now).

Logs are being ingested ok, and my input for the deployment app looks like:

[monitor:///usr/local/bro/logs/current]
disabled = 0
sourcetype = bro
index = bro
whitelist = \.log$

The sourcetype is appearing ok but the field extractions aren't working. Am I missing an install/config step?

Re: Why is the Splunk Add-on for Bro IDS not automatically extracting the fields?

alexlomas — Wed, 08 Jun 2016 15:09:37 GMT

For others' info, universal forwarders are not supported for Bro, you have to run a heavy forwarder with the Bro app installed. Once you have that then the fields extraction works as intended.